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OVERSIGHT OF THE STATE DEPARTMENT 


Thursday, July 7, 2016 

House of Representatives, 

Committee on Oversight and Government Reform, 

Washington, D.C. 

The committee met, pursuant to call, at 10:04 a.m., in Room 
2154, Rayburn House Office Building, Hon. Jason Chaffetz [chair- 
man of the committee] presiding. 

Present: Representatives Chaffetz, Mica, Duncan, Jordan, 
Walberg, Amash, Gosar, DesJarlais, Gowdy, Farenthold, Lummis, 
Massie, Meadows, DeSantis, Mulvaney, Buck, Walker, Blum, Hice, 
Russell, Carter, Grothman, Hurd, Palmer, Cummings, Maloney, 
Norton, Clay, Lynch, Cooper, Connolly, Cartwright, Duckworth, 
Kelly, Lawrence, Lieu, Watson Coleman, Plaskett, DeSaulnier, 
Boyle, Welch, and Lujan Grisham. 

Chairman Chaffetz. The Committee on Oversight and Govern- 
ment Reform will come to order. 

Without objection, the chair is authorized to declare a recess at 
any time. 

I want to thank Director Comey for being here and doing so on 
short notice. I have the greatest admiration for the FBI. My grand- 
father was a career FBI agent. 

I have got to tell you, I am here because we are mystified and 
confused by the fact pattern that you laid out and the conclusions 
that you reached. It seems that there are two standards, and there 
is no consequence for these types of activities and dealing in a care- 
less way with classified information. It seems to a lot of us that the 
average Joe, the average American, that if they had done what you 
laid out in your statement, that they’d be in handcuffs and they 
might be on their way to jail, and they probably should, and I 
think there is a legitimate concern that there is a double standard. 
If your name isn’t Clinton or you’re not part of the powerful elite, 
that Lady Justice will act differently. It is a concern that Lady Jus- 
tice will take off that blindfold and come to a different conclusion. 

Hillary Clinton created this mess. It wasn’t Republicans. It 
wasn’t anybody else. She made a very conscious decision. On the 
very day that she started her Senate confirmation, she set up and 
got a domain name and set up a system to avoid and bypass the 
safety, security, and the protocol of the State Department. 

Classified information is classified for a reason. It is classified be- 
cause if it were to get out into the public, there are nefarious ac- 
tors, nation-states, others that want to do harm to this country, 
and there are people who put their lives on the line protecting and 
serving our country, and when those communications are not se- 
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cure, it puts their lives at jeopardy. This classified information is 
entrusted to very few, but there is such a duty and an obligation 
to protect that, to fall on your sword to protect that, and yet there 
doesn’t seem to be any consequence. 

You know, I was talking to Trey Gowdy, and he made a really 
good point with us yesterday. Mr. Gowdy said, you know, in your 
statement, Mr. Director, you mentioned that there was no prece- 
dent for this, but we believe that you have set a precedent, and it’s 
a dangerous one. The precedent is if you sloppily deal with classi- 
fied information, if you are cavalier about it — and it wasn’t just an 
innocent mistake; this went on for years — that there is going to be 
no consequence. 

We are a different nation in the United States of America. We 
are self-critical. Most nations would never do this, but we do it in 
the spirit of making ourselves better. There will be all kinds of ac- 
cusations about political this and political that. I have defended 
your integrity every step of the way. You are the definitive voice. 
I stand by that, but I am mystified, and I am confused, because you 
listen to your fact pattern and come to the conclusion that there 
is no consequence, I don’t know how to explain that. We will have 
constituents ask us. They’ll get mad. They will pound the — ^you 
know, they’re frustrated. They have seen this happen time and 
time again. I don’t know how to explain it, and I hope that, 
through this hearing, we can stick to the facts and understand this, 
because there does seem to be two standards. There does seem to 
be no consequence, and I want to understand that, and I want to 
be able to explain that to the person that’s sitting at home, and 
that is why we are here. 

And so I yield back. 

I now recognize the ranking member, Mr. Cummings. 

Mr. Cummings. Director Comey, thank you for being here today. 
I want to begin by commending you and the public servants at the 
FBI for the independent investigation you conducted. You had a 
thankless task. No matter what recommendation you made, you 
were sure to be criticized. There is no question that you were ex- 
tremely thorough. In fact, some may even say you went too far in 
your investigation. But, of course, that was your job; that is your 
job. 

Secretary Clinton has acknowledged that she made a mistake in 
using a personal email account, and you explained on Tuesday that 
she and her colleagues at the State Department were extremely 
careless with their emails, but after conducting this exhaustive re- 
view, you determined that no reasonable prosecutor would bring a 
case based on this evidence, and you and the career staff rec- 
ommended against prosecution. Based on the previous cases you 
examined, if prosecutors had gone forward, they would have been 
holding the Secretary to a different standard from everyone else. 

Amazingly — amazingly — some Republicans who were praising 
you just days ago for your independence, for your integrity, and 
your honesty instantly turned against you because your rec- 
ommendation conflicted with the predetermined outcome they 
wanted. In their eyes, you had one job and one job only: to pros- 
ecute Hillary Clinton. 
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But you refused to do so, so now you are being summoned here 
to answer for your alleged transgressions, and in a sense, Mr. Di- 
rector, you are on trial. 

Contrary to the claims of your critics, there is absolutely no evi- 
dence that you made your recommendation for political reasons, no 
evidence that you were bribed or coerced or influenced, no evidence 
that you came to your conclusion based upon anything but the facts 
and the law. I firmly believe that your decision was not based on 
convenience but on conviction. 

Today, House Republicans are doing what they always do, using 
taxpayers’ money to continue investigating claims that have al- 
ready been debunked just to keep them in the headlines one more 
day. When they hear a political siren, they rush toward it over and 
over again, even if the evidence is not there. Exhibit A, Majority 
Leader Kevin McCarthy, who admitted on national television that 
Republicans established the Benghazi Select Committee to bring 
down Secretary Clinton’s poll numbers. I didn’t say that; McCarthy 
said it. The fact was confirmed by a Republican staffer on that 
committee who reported that he was fired in part for not going 
along with the hyper focus on Secretary Clinton. 

I give House Republicans credit. They certainly are not shy about 
what they are doing. They have turned political investigations into 
an art form. 

If our concerns here today are with the proper treatment of clas- 
sified information, then we should start with the review of our pre- 
vious hearing on General David Petraeus, who pled guilty last year 
to intentionally and knowingly compromising highly classified in- 
formation. The problem is, Mr. Director, we never had that hear- 
ing. This committee ignored that breach of national security be- 
cause it did not match the political goals of the House Republicans. 

If our concerns today were with finally addressing a broken clas- 
sification system in which security levels are arbitrarily changed 
up and down, that would have been a legitimate goal, that would 
have been a valuable addition to reforming and improving our gov- 
ernment. After all, we are the Government Reform Committee. 

We could have held hearings here on Zika, the Zika virus, pre- 
venting gun massacres like the one in Orlando, or a host of other 
topics that could actually save people’s lives, but that is not why 
we are here. That is not why our chairman called this emergency 
hearing 48 hours after you made your recommendation. 

Everyone knows what this committee is doing. Honestly, I would 
not be surprised — and I say this with all seriousness — I would not 
be surprised if, tomorrow. Republicans set up a new committee to 
spend $7 million plus on why the EBI failed to prosecute Hillary 
Clinton. 

Director Comey, let me conclude with this request. Even with all 
that I have said, I believe that there is a critical role for you today. 
I have listened carefully to the coverage on this issue, and I have 
heard people say as recently as this morning, 3 hours ago, that 
they were mystified by your decision. As a matter of fact, the chair- 
man repeated it a minute ago. And so there is a perceived gap be- 
tween the things you said on Tuesday and your recommendation. 
There is a gap, Mr. Director. So, in this moment — and this is a crit- 
ical moment — I beg you to fill the gap, because when the gap is not 
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filled by you, it will be filled by others. Share with us, the Amer- 
ican people, your process and your thinking; explain how you exam- 
ined the evidence, the law, and the precedents; describe in clear 
terms how you and your team, career professionals, arrived at this 
decision. If you can do that today, if you can do that, that could 
go a long way toward people understanding your decision. 

Finally, I want to make it clear that I condemn these completely 
unwarranted political attacks against you. They have attacked you 
personally. They have attacked your integrity. They have impugned 
your professionalism. And they have even suggested that you were 
somehow bought and paid for because you made your recommenda- 
tion based upon the law and the facts. 

I know you are used to working in the world of politics, but these 
attacks have been beyond the pale. So you do not deserve this. 
Your family does not deserve it. And the highly skilled and dedi- 
cated agents of the FBI do not deserve it. 

I honor your professionalism and your service to our country. 
And, again, even if it takes till hell freezes over, I beg you to close 
the gap, tell us what happened between what you found and your 
decision so that not only the members of this panel and this Con- 
gress will understand but so that Americans will understand. And 
if you do that, if you do that, then it will be all worth it today. 

With that, I yield back. 

Mr. Mica. Mr. Chairman 

Chairman Chaffetz. I think — hold on one second, with your in- 
dulgence. 

To the ranking member, of which I have the greatest respect, you 
asked for a hearing on General Petraeus and how that was dealt 
with; you got it. We will have one in this Oversight Committee. 
And the record will reflect that, in the Judiciary Committee, I re- 
peatedly questioned Attorney General Holder, I repeatedly ques- 
tioned the FBI Director about the disposition of that case, probably 
more than any Member in the House or Senate. And if you want 
a hearing, we will do that. 

Mr. Cummings. Will the gentlemen yield? 

Chairman Chaffetz. Yes. 

Mr. Cummings. Thank you. 

Chairman Chaffetz. Number two, you complained that we 
haven’t done a hearing on Zika. The Oversight and Government 
Reform Committee, I believe, was the very first committee to actu- 
ally do a hearing on Zika. That was chaired by Mr. Mica, and I am 
proud of the fact that we did a Zika hearing, and we did it first. 

Mr. Cummings. Will the gentleman yield? 

Chairman Chaffetz. Sure. 

Mr. Cummings. Can we have another one, because the problem 
is still there 

Chairman Chaffetz. Absolutely. 

Mr. Cummings. — big time. 

Chairman Chaffetz. Absolutely. 

Mr. Mica. Mr. Chairman, I would ask for a unanimous consent 
request that we put the date of the hearing in the record at this 
time that I chaired — thank you — on Zika. 

Chairman Chaffetz. Absolutely. 

[The information follows:] 
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The Subcommittee on Transportation and Public Assets held a 
hearing on February 24, 2016, titled, “The Zika Virus: Coordination 
of a Multi- Agency Response.” 

Chairman Chaffetz. And the ranking member knows that we 
have held multiple hearings on the criminal justice and criminal 
justice reform. You asked for it. You are passionate about it. And 
we did do that as well. So to suggest we haven’t addressed some 
of those issues, I think, is inaccurate. 

Mr. Cummings. I don’t think I did that, Mr. Chairman, but, 
again, as late as yesterday, with the problem in Minnesota with an 
African American man being killed, I would like to have some hear- 
ings still on the criminal justice system. Thank you. 

Chairman Chaffetz. Thank you. 

Mr. Cummings. Thank you very much. 

Chairman Chaffetz. Without objection. I am going to work with 
you on that 

Mr. Cummings. Thank you. 

Chairman Chaffetz. — as I have every step of the way. 

Mr. Cummings. Thank you, Mr. Chairman. I appreciate it. 

Chairman Chaffetz. Without objection, the chair is authorized 
to declare a recess at any time. We will hold the record open for 
5 legislative days for any members who would like to submit a 
written statement. 

We will now recognize our distinguished witness for our first 
panel. I am pleased to welcome the Honorable James Comey, the 
Director of the Federal Bureau of Investigations. 

We welcome Director Comey, and thank you for being here. 

Pursuant to committee rules, all witnesses are to be sworn before 
they testify. If you will please rise and raise and right hand. 

Do you solemnly swear or affirm that the testimony you are 
about to give is the truth, the whole truth, and nothing but the 
truth. 

Mr. Comey. I do. 

Chairman Chaffetz. Thank you. 

Let the record reflect that the witness answered in the affirma- 
tive. 

Mr. Comey, the floor is yours. You can take as long or as short 
as you would like. If you have any written statement that you 
would like to submit afterwards, we are happy to do that as well, 
and it will be made part of the record. The time is now yours. 

Director Comey, you are recognized. 

STATEMENT OF THE HONORABLE JAMES COMEY 

Mr. Comey. Thank you, Mr. Chairman, Mr. Cummings, members 
of the committee. I am proud to be here today representing the peo- 
ple of the FBI, who did this investigation, as they do all their work, 
in a competent, honest, and independent way. I believe this inves- 
tigation was conducted consistent with the highest traditions of the 
FBI. Our folks did it in an apolitical and professional way, includ- 
ing our recommendation as to the appropriate resolution of this 
case. 

As I said in my statement on Tuesday, I expected there would 
be significant public debate about this recommendation, and I am 
a big fan of transparency, so I welcome the conversation we are 
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going to have here today. And I do think a whole lot of folks have 
questions about, so why did we reach the conclusion we did, and 
what was our thinking? And I hope very much to get an oppor- 
tunity to address that and to explain it. And I hope, at the end of 
day, people can disagree, can agree, but they will at least under- 
stand that the decision was made and the recommendation was 
made the way you would want it to be: by people who didn’t give 
a hoot about politics but who cared about, what are the facts, what 
is the law, and how have similar people, all people, been treated 
in the past? 

Maybe I could just say a few words at the beginning that would 
help frame how we think about this. There are two things that 
matter in a criminal investigation of a subject: What did the person 
do? And when they did that thing, what were they thinking? 

When you look at the hundred years plus of the Justice Depart- 
ment’s investigation and prosecution of the mishandling of classi- 
fied information, those two questions are obviously present: What 
did the person do? Did they mishandle classified information? And 
when they did it, did they know they were doing something that 
was unlawful? That has been the characteristic of every charged 
criminal case involving the mishandling of classified information. I 
am happy to go through the cases in particular. 

In our system of law, there’s a thing called mens rea. It’s impor- 
tant to know what you did, but when you did it, this Latin phrase 
“mens rea” means, what were you thinking? And we don’t want to 
put people in jail unless we prove that they knew they were doing 
something they shouldn’t do. That is the characteristic of all the 
prosecutions involving mishandling of classified information. 

There is a statute that was passed in 1917 that, on its face, 
makes it a crime, a felony, for someone to engage in gross neg- 
ligence. So that would appear to say: Well, maybe in that cir- 
cumstance, you don’t need to prove they knew they were doing 
something that was unlawful; maybe it’s enough to prove that they 
were just really, really careless, beyond a reasonable doubt. 

At the time Congress passed that statute in 1917, there was a 
lot of concern in the House and the Senate about whether that was 
going to violate the American tradition of requiring that, before 
you’re going to lock somebody up, you prove they knew they were 
doing something wrong, and so there was a lot of concern about it. 
The statute was passed. As best I can tell, the Department of Jus- 
tice has used it once in the 99 years since, reflecting that same con- 
cern. I know, from 30 years with the Department of Justice, they 
have grave concerns about whether it’s appropriate to prosecute 
somebody for gross negligence, which is why they’ve done it once 
that I know of in a case involving espionage. 

And so when I look at the facts we gathered here, as I said, I 
see evidence of great carelessness, but I do not see evidence that 
is sufficient to establish that Secretary Clinton or those with whom 
she was corresponding both talked about classified information on 
email and knew, when they did it, they were doing something that 
was against the law, right? 

So, given that assessment of the facts and my understanding of 
the law, my conclusion was and remains no reasonable prosecutor 
would bring this case. No reasonable prosecutor would bring the 
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second case in a hundred years focused on gross negligence. And 
so I know that’s been a source of some confusion for folks. That’s 
just the way it is. I know the Department of Justice. I know no rea- 
sonable prosecutor would bring this case. I know a lot of my former 
friends are out there saying they would. I wonder where they were 
the last 40 years, because I’d like to see the cases they brought on 
gross negligence. Nobody would; nobody did. 

So my judgment was the appropriate resolution of this case was 
not with a criminal prosecution. As I said, folks can disagree about 
that, but I hope they know that view, not just my view but of my 
team, was honestly held, fairly investigated, and communicated 
with unusual transparency, because we know folks care about it. 

So I look forward to this conversation. I look forward to answer- 
ing as many questions as I possibly can. I’ll stay as long as you 
need me to stay, because I believe transparency matters tremen- 
dously. And I thank you for the opportunity. 

Chairman Chaffetz. Thank you. Director. I’m going to recognize 
myself here. 

Physically, where were Hillary Clinton’s servers? 

Mr. CoMEY. The operational server was in the basement of her 
home in New York. The reason I’m answering it that way is be- 
cause sometimes, after they were decommissioned, they were 
moved to other facilities, storage facilities, but the live device was 
always in the basement. 

Chairman Chaefetz. Was that an authorized or unauthorized lo- 
cation? 

Mr. COMEY. It was an unauthorized location for the transmitting 
of classified information. 

Chairman Chaffetz. Is it reasonable or unreasonable to expect 
Hillary Clinton would receive and send classified information? 

Mr. CoMEY. As Secretary of State? Reasonable that the Secretary 
of State would encounter classified information in the course of the 
Secretary’s work. 

Chairman Chaffetz. Via email? 

Mr. CoMEY. Sure, depending upon the nature of the system. To 
communicate classified information, it would have to be a classi- 
fied-rated email system. 

Chairman Chaffetz. But you did find more than 100 emails that 
were classified that had gone through that server, correct? 

Mr. CoMEY. Right. Through an unclassified server, correct. 

Chairman Chaffetz. Yes. So Hillary Clinton did come to possess 
documents and materials containing classified information via 
email on these unsecured servers, correct? 

Mr. CoMEY. That is correct. 

Chairman Chaffetz. Did Hillary Clinton lie? 

Mr. CoMEY. To the FBI? We have no basis to conclude she lied 
to the FBI. 

Chairman Chaffetz. Did she lie to the public? 

Mr. CoMEY. That’s a question I’m not qualified to answer. I can 
speak about what she said to the FBI. 

Chairman Chaffetz. Did Hillary Clinton lie under oath? 

Mr. CoMEY. To the — not to the FBI, not in the case we were 
working. 
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Chairman Chaffetz. Did you review the documents where Con- 
gressman Jim Jordan asked her specifically, and she said, quote, 
“There was nothing marked classified on my emails, either sent or 
received,” end quote? 

Mr. COMEY. I don’t remember reviewing that particular testi- 
mony. I’m aware of that being said, though. 

Chairman Chaffetz. Did the FBI investigate her statements 
under oath on this topic? 

Mr. CoMEY. Not to my knowledge. I don’t think there has been 
a referral from Congress. 

Chairman Chaffetz. Do you need a referral from Congress to in- 
vestigate her statements under oath? 

Mr. CoMEY. Sure do. 

Chairman Chaffetz. You’ll have one. You’ll have one in the next 
few hours. 

Did Hillary Clinton break the law? 

Mr. COMEY. In connection with her use of the email server, my 
judgment is that she did not. 

Chairman Chaffetz. Did you — you’re just not able to prosecute 
it, or did Hillary Clinton break the law? 

Mr. COMEY. Well, I don’t want to give an overly lawyerly answer, 
but the question I always look at is, is there evidence that would 
establish beyond a reasonable doubt that somebody engaged in con- 
duct that violated a criminal statute? And my judgment here is 
there is not. 

Chairman Chaffetz. The FBI does background checks. If Hillary 
Clinton applied for the job at the FBI, would the FBI give Hillary 
Clinton a security clearance? 

Mr. CoMEY. I don’t want to answer a hypothetical. The FBI has 
a robust process in which we adjudicate the suitability of people for 
employment in the Bureau. 

Chairman Chaffetz. Given the fact pattern you laid out less 
than 48 hours ago, would a person who had dealt with classified 
information like that, would that person be granted a security 
clearance at the FBI? 

Mr. CoMEY. It would be a very important consideration in the 
suitability determination. 

Chairman Chaffetz. You’re kind of making my point. Director. 
The point being, because I injected the word “Hillary Clinton,” you 
gave me a different answer, but if I came up to you and said that 
this person was extremely careless with classified information; the 
exposure to hostile actors; had used — despite warnings — created 
unnecessary burdens and exposure; if they said that they had one 
device and you found out that they had multiple devices; if there 
had been email chains with somebody like Jake Sullivan asking for 
classification changes, you’re telling me that the FBI would grant 
a security clearance to that person? 

Mr. COMEY. I’m not — I hope I’m giving a consistent — I’m not say- 
ing what the answer would be. I’m saying that would be an impor- 
tant consideration in a suitability determination for anybody. 

Chairman Chaffetz. And just — personally, I just think that 
sounds like a bit of a political answer, because I can’t imagine that 
the FBI would grant a security clearance to somebody with that 
fact pattern. Do you agree or disagree with that? 
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Mr. CoMEY. I’ll say what I said before: again, it’s very hard to 
answer in a hypothetical. I’ll repeat it. It would be a very impor- 
tant consideration in a suitability determination. 

Chairman Chaffetz. Did Hillary Clinton do anything wrong? 

Mr. Comfy. What do you mean by “wrong”? 

Chairman Chaffetz. I think it’s self-evident. 

Mr. Comfy. Well, I’m a lawyer. I’m an investigator. And I’m — 
I hope — a normal human being. 

Chairman Chaffetz. Do you really believe there should be no 
consequence for Hillary Clinton in how she dealt with this? 

Mr. Comfy. Well, I didn’t say — I hope folks remember what I 
said on Tuesday. I didn’t say there’s no consequence for someone 
who violates the rules regarding the handling of classified informa- 
tion. There are often very severe consequences in the FBI involving 
their employment, involving their pay, involving their clearances. 
That’s what I said on Tuesday. And I hope folks walk away under- 
standing that, just because someone’s not prosecuted for mis- 
handling classified information, that doesn’t mean, if you work in 
the FBI, there aren’t consequences for it. 

Chairman Chaffetz. So if Hillary Clinton or if anybody had 
worked at the FBI, under this fact pattern, what would you do to 
that person? 

Mr. Comfy. There would be a security review and an adjudica- 
tion of their suitability, and a range of discipline could be imposed 
from termination to reprimand and, in between, suspensions, loss 
of clearance. So you could be walked out or you could — depending 
upon the nature of the facts, you could be reprimanded, but there 
is a robust process to handle that. 

Chairman Chaffetz. I’ve gone past my time. 

I yield back. 

I now recognize the ranking member, Mr. Cummings. 

Mr. Cummings. Thank you very much. 

Director Comey — and I want to thank you very much for being 
here today, especially on such short notice. You and your staff 
should be commended for the thorough and dedicated review you 
conducted. Unfortunately, some of my colleagues are now attacking 
you personally because your final recommendation conflicted with 
their preconceived political outcome in this case. 

Some have tried to argue that this case is far worse than the 
case of General David Petraeus, who was convicted in 2015 of 
knowingly and intentionally compromising highly classified infor- 
mation. In fact, one very vocal politician we all know said this, and 
I quote: “If she isn’t indicted, the only reason is because the Demo- 
crats are protecting her. She is being protected 100 percent, be- 
cause you look at David — General Petraeus, you look at all the 
other people that did a fraction of what she did, but she has much 
worse judgment than he had, and she’s getting away with it, and 
it’s unfair to him,” end of quote. 

Director Comey, you were the Director of the FBI when General 
Petraeus pled guilty. Is that right? 

Mr. Comey. Yes. 

Mr. Cummings. If I understand that case correctly. General 
Petraeus kept highly classified information in eight personal note- 
books at his private residence. Is that correct? 
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Mr. CoMEY. That is correct. 

Mr. Cummings. According to the filings in that case, this note- 
book included the identities of covert officers. They also included 
war strategy, intelligence capabilities, diplomatic discussions, 
quotes and deliberative discussions from high-level National Secu- 
rity Council meetings and discussions with the President. General 
Petraeus shared his information with his lover and then biog- 
rapher. He was caught on audiotape telling her, and I quote, “I 
mean, they are highly classified, some of them. They don’t have it 
on — on it, but, I mean, there’s code word stuff in there,” end of 
quote. 

Director Comey, what did General Petraeus mean when he said 
he intentionally shared, quote, “code word” information with her? 
What does that mean? 

Mr. Comey. The Petraeus case, to my mind, illustrates perfectly 
the kind of cases the Department of Justice is willing to prosecute. 
Even there, they prosecuted him for a misdemeanor. In that case, 
you had vast quantities of highly classified information, including 
special — sensitive compartmented information — that’s the reference 
to code words — a vast quantity of it, not only shared with someone 
without authority to have it, but we found it in a search warrant 
hidden under the insulation in his attic, and then he lied to us 
about it during the investigation. 

So you have obstruction of justice. You have intentional mis- 
conduct and a vast quantity of information. He admitted he knew 
that was the wrong thing to do. That is a perfect illustration of the 
kind of cases that get prosecuted. In my mind, it illustrates, impor- 
tantly, the distinction to this case. 

Mr. Cummings. And General Petraeus did not admit to these 
facts when the FBI investigators first interviewed him. Did he? 

Mr. Comey. No. He lied about it. 

Mr. Cummings. But he did admit to these facts in a plea agree- 
ment. Is that correct? 

Mr. Comey. Yes. 

Mr. Cummings. Here’s what the Department filing said about 
General Petraeus, and I quote: “The acts taken by defendant David 
Howell Petraeus were in all respects knowing and deliberate and 
were not committed by mistake, accident, or other innocent rea- 
son,” end of quote. 

Is that an accurate summary, in your view. Director Comey? 

Mr. Comey. Yes. It actually leaves out an important part of the 
case, which is the obstruction of justice. 

Mr. Cummings. Was he charged with obstruction of justice? 

Mr. Comey. No. 

Mr. Cummings. And why not? 

Mr. Comey. A decision made by the leadership of the Depart- 
ment of Justice not to insist upon a plea to that felony. 

Mr. Cummings. So the question is, do you agree with the claim 
that General Petraeus, and I quote, “got in trouble for far less,” end 
of quote? 

Mr. Comey. No. 

Mr. Cummings. Do you agree with that statement? 

Mr. Comey. No. It’s the reverse. 

Mr. Cummings. And what do you mean by that? 
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Mr. CoMEY. His conduct, to me, illustrates the categories of be- 
havior that mark the prosecutions that are actually brought: clear- 
ly intentional conduct, knew what he was doing was a violation of 
the law, huge amounts of information that, even if you couldn’t 
prove he knew it, it raises the inference that he did it — right — an 
effort to obstruct justice. That combination of things makes it wor- 
thy of a prosecution, a misdemeanor prosecution but a prosecution 
nonetheless. 

Mr. Cummings. Sitting here today, do you stand by the FBI’s rec- 
ommendation to prosecute General Petraeus? 

Mr. CoMEY. Oh, yeah. 

Mr. Cummings. Do you stand by the FBI’s recommendation not 
to prosecute Hillary Clinton? 

Mr. CoMEY. Yes. 

Mr. Cummings. Director Comey, how many times have you testi- 
fied before Congress about the General Petraeus case? Do you 
know? 

Mr. Comey. I don’t think I’ve ever testified — I don’t think I’ve 
testified about it at all. I don’t think so. 

Mr. Cummings. With that, I would yield back. 

Chairman Chaffetz. I have to check the record, but I believe I 
asked you a question about it at the time, but maybe not. 

Mr. Comey. You could have. That’s why I was 

Chairman Chaffetz. Yeah, yeah. 

Mr. Comey. — squinching my face. It could have been at a Judici- 
ary Committee hearing I was asked about it. 

Chairman Chaffetz. Yeah. 

We’ll now recognize the gentleman from South Carolina, Mr. 
Gowdy, for 5 minutes. 

Mr. Gowdy. Good morning. Director Comey. Secretary Clinton 
said she never sent or received any classified information over her 
private email. Was that true? 

Mr. Comey. Our investigation found that there was classified in- 
formation sent 

Mr. Gowdy. So it was not true? 

Mr. Comey. Right. That’s what I said. 

Mr. Gowdy. Okay. Well, I’m looking for a little shorter answer 
so you and I are not here quite as long. 

Secretary Clinton said there was nothing marked classified on 
her emails either sent or received. Was that true? 

Mr. Comey. That’s not true. There were a small number of por- 
tion markings on, I think, three of the documents. 

Mr. Gowdy. Secretary Clinton said: I did not email any classified 
material to anyone on my email. There is no classified material. 

Was that true? 

Mr. Comey. No. There was classified material emailed. 

Mr. Gowdy. Secretary Clinton said she used just one device. Was 
that true? 

Mr. Comey. She used multiple devices during the 4 years of her 
term as Secretary of State. 

Mr. Gowdy. Secretary Clinton said all work-related emails were 
returned to the State Department. Was that true? 

Mr. Comey. No. We found work-related emails, thousands, that 
were not returned. 
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Mr. Gowdy. Secretary Clinton said neither she nor anyone else 
deleted work-related emails from her personal account. Was that 
true? 

Mr. CoMEY. That’s a harder one to answer. We found traces of 
work-related emails on devices or in slack space, whether they 
were deleted or whether when a server was changed out, some- 
thing happened to them. There’s no doubt that there were work- 
related emails that were removed electronically from the email sys- 
tem. 

Mr. Gowdy. Secretary Clinton said her lawyers read every one 
of the emails and were overly inclusive. Did her lawyers read the 
email content individually? 

Mr. CoMEY. No. 

Mr. Gowdy. Well, in the interests of time and because I have a 
plane to catch tomorrow afternoon. I’m not going to go through any 
more of the false statements, but I am going to ask you to put on 
your old hat. 

False exculpatory statements, they are used for what? 

Mr. CoMEY. Well, either for a substantive prosecution or for evi- 
dence of intent in a criminal prosecution. 

Mr. Gowdy. Exactly. Intent and consciousness of guilt, right? Is 
that right? 

Mr. COMEY. Right. 

Mr. Gowdy. Consciousness of guilt and intent. 

Mr. COMEY. Uh-huh. 

Mr. Gowdy. In your old job, you would prove intent, as you just 
referenced, by showing the jury evidence of a complex scheme that 
was designed for the very purpose of concealing the public record, 
and you would be arguing, in addition to concealment, the destruc- 
tion that you and I just talked about or certainly the failure to pre- 
serve, you would argue all of that under the heading of content — 
you would also — intent. 

You would also be arguing the pervasiveness of the scheme, 
when it started, when it ended, and the number of emails, whether 
they were originally classified or up classified. You would argue all 
of that under the heading of intent. 

You would also probably, under common scheme or plan, argue 
the burn bags of daily calendar entries or the missing daily cal- 
endar entries as a common scheme or plan to conceal. 

Two days ago. Director, you said a reasonable person in her posi- 
tion should have known a private email was no place to send and 
receive classified information. You’re right. An average person does 
know not to do that. This is no average person. This is a former 
First Lady, a former United States Senator, and a former Secretary 
of State that the President now contends is the most competent, 
qualified person to be president since Jefferson. He didn’t say that 
in 2008, but he says it now. She affirmatively rejected efforts to 
give her a State.gov account, she kept these private emails for al- 
most 2 years, and only turned them over to Congress because we 
found out she had a private email account. 

So you have a rogue email system set up before she took the oath 
of office, thousands of what we now know to be classified emails, 
some of which were classified at the time, one of her more frequent 
email comrades was, in fact, hacked, and you don’t know whether 
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or not she was, and this scheme took place over a long period of 
time and resulted in the destruction of public records, and yet you 
say there is insufficient evidence of intent. You say she was ex- 
tremely careless but not intentionally so. 

You and I both know intent is really difficult to prove. Very rare- 
ly do defendants announce: On this day, I intend to break this 
criminal code section. Just to put everyone on notice, I am going 
to break the law on this date. 

It never happens that way. You have to do it with circumstantial 
evidence, or if you’re Congress and you realize how difficult it is 
to prove specific intent, you will formulate a statute that allows for 
gross negligence. 

My time is out, but this is really important. You mentioned 
there’s no precedent for criminal prosecution. My fear is there still 
isn’t. There’s nothing to keep a future Secretary of State or Presi- 
dent from this exact same email scheme or their staff. And my real 
fear is this — it’s what the chairman touched upon — this double 
track justice system that is, rightly or wrongly, perceived in this 
country that if you are a private in the Army and you email your- 
self classified information, you will be kicked out, but if you are 
Hillary Clinton and you seek a promotion to Commander in Chief, 
you will not be. 

So what I hope you can do today is help the average — the reason- 
able person you made reference to, the reasonable person under- 
stand why she appears to be treated differently than the rest of us 
would be. 

With that, I would yield back. 

Chairman Chaffetz. We’ll now recognize the gentlewoman from 
New York, Mrs. Maloney. 

Mrs. Maloney. Director, thank you for your years of public serv- 
ice. You have distinguished yourself as the assistant U.S. attorney 
for both the Southern District of New York and the Eastern Dis- 
trict of Virginia. That’s why you were appointed by President Bush 
to be the Deputy Attorney General at the Department of Justice 
and why President Obama appointed you as the Director of the FBI 
in 2013. 

Despite your impeccable reputation for independence and integ- 
rity, Republicans have turned on you with a vengeance imme- 
diately after you announced your recommendation not to pursue 
criminal charges against Secretary Clinton. Let me give you some 
examples. Representative Turner said, and I quote: “The investiga- 
tion by the FBI is steeped in political bias,” end quote. 

Was your investigation steeped in political bias, yes or no? 

Mr. CoMEY. No. It was steeped in no kind of bias. 

Mrs. Maloney. Thank you. The Speaker of the House, Paul 
Ryan, was even more critical. He accused you of not applying the 
law equally. He said your recommendation shows, and I quote, “the 
Clintons are living above the law. They’re being held to a different 
set of standards. That is clearly what this looks like,” end quote. 

How do you respond to his accusations that you held the Clintons 
to a different set of standards than anyone else? Did you hold them 
to a different standard or the same standard? 
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Mr. COMEY. It’s just not — it’s just not accurate. We try very hard 
to apply the same standard whether you’re rich or poor, white or 
black, old or young, famous or not known at all. 

I just hope folks will take the time to understand the other cases, 
because there’s a lot of confusion out there about what the facts 
were of the other cases that I understand lead good people, reason- 
able people, to have questions. 

Mrs. Maloney. Senator Cruz also criticized you. He said that 
there are, and I quote, “serious concerns about the integrity of Di- 
rector Comey’s decision.” He stated that you, quote, you “had re- 
written a clearly worded Federal criminal statute.” 

Did you rewrite the law in any way or rewrite any statute? 

Mr. CoMEY. No. 

Mrs. Maloney. Now, I hesitate, I truly hesitate to mention the 
next one, but Donald Trump took these conspiracy theories to a to- 
tally new level. He said, and I quote: “It was no accident that 
charges were not recommended against Hillary the exact same day 
as President Obama campaigned with her for the first time.” 

So did you plan the timing of your announcement to help Sec- 
retary Clinton’s campaign event on Tuesday? 

Mr. COMEY. No. The timing was entirely my own. Nobody knew 
I was going to do it, including the press. I’m very proud of the way 
the FBI — nobody leaked that. We didn’t coordinate it, didn’t tell. 
Just not a consideration. 

Mrs. Maloney. Thank you. Mr. Trump also claimed that Sec- 
retary Clinton bribed the Attorney General with an extension of 
her job and I guess this somehow affected your decision. 

I know it’s a ridiculous question, but I have to ask it. Did you 
make your decision because of some kind of bribe to the Attorney 
General? 

Mr. CoMEY. No. 

Mrs. Maloney. I tell you, are you surprised, as I am, by the in- 
tensity of the attacks from the GOP on you after having made a 
decision, a thoughtful decision, an independent decision with the 
professional staff of the FBI? 

Mr. CoMEY. I’m not surprised by the intense interest and debate. 
I predicted it. I think it’s important that we talk about these 
things. They inevitably become focused on individual people. That’s 
okay. We’ll just continue to have the conversation. 

Mrs. Maloney. I believe that what we’re seeing today is that if 
the GOP does not like the results of an investigation or how it 
turns out — and we saw they originally were lauding you — the 
minute you made your announcement, they’re now attacking you, 
the same people. And now I predict they’ll be calling for more hear- 
ings, more investigations, all at the expense of the taxpayer, and 
they do this instead of working on what the American people really 
care about. They want Congress to focus on jobs, the environment. 
Homeland Security, the security of our Nation, affordable childcare, 
affordable college educations, and an economy that works and helps 
all people. 

I thank you for performing your job with distinction and the long 
history of your whole profession of integrity and independence. And 
thank you very much. My time has expired. 

Chairman Chaffetz. I thank the gentlewoman. 
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We’ll now recognize the gentleman from Ohio, Mr. Jordan, for 5 
minutes. 

Mr. Jordan. Thank you, Mr. Chairman. 

Director, thank you for being with us. On Tuesday, you said any 
reasonable person in Secretary Clinton’s position should have 
known that an unclassified system was no place for these conversa- 
tions. You said on Tuesday some of her emails bore classified mark- 
ings, and you also said on Tuesday there were potential violations 
of the appropriate statutes. 

Now, I know a bunch of prosecutors back home would look at 
that fact pattern, look at that evidence, you even referenced in your 
opening statement, some of your prosecutor — friends in the pros- 
ecution business have been on TV and said they would have looked 
at that same evidence and they would have taken it to a grand 
jury, but on Tuesday, you said and, today, in your opening state- 
ment, you said no reasonable prosecutor would bring such a case. 
And then in your statement Tuesday, you cite factors that helped 
you make that decision and make that statement, and one of the 
factors you said was consider the context of a person’s actions. 

Now, typically, when I hear “context” in the course of a criminal 
investigation, it’s from the defense side, not the prosecution side; 
it’s at the end of the case, after there’s been a trial and a guilty 
verdict; and it’s during the sentencing phase, mitigating cir- 
cumstances. That’s the context we typically think about, but you 
said it on the front end. You said “consider the context of the per- 
son’s actions,” and so I’m curious, what does “consider the context” 
mean? Because a lot of Americans are thinking just what the chair- 
man talked about in his opening statement, that there are two 
standards, one for we the people and one for the politically con- 
nected. A lot of folks I get the privilege of representing back in 
Ohio think that when you said “consider the context,” they think 
that’s what Mr. Gowdy just talked about, the fact that she’s a 
former First Lady, former Secretary of State, former Senator, major 
party’s nominee for the highest office in the land, and, oh, by the 
way, her husband just met with the individual you work with at 
an airport in Arizona 5 days ago. 

So you said none of that influenced your decision, but tell us 
what “consider the context” means. 

Mr. CoMEY. Yeah. Thank you, Mr. Jordan. What I was trying to 
capture is the fact that the exercise of prosecutorial discretion is 
always a judgment call, it is in every single case, and among the 
things you consider are, what was this person’s background? What 
was the circumstances of the offense? Were they drunk? Were they 
inflamed by passion? Was it somebody who had a sufficient level 
of education and training and experience that we can infer certain 
things from that, to consider the entire circumstances of the per- 
son’s offense conduct and background? I did not mean to consider 
political context. 

Mr. Jordan. Okay. The entire circumstances, and Mr. Gowdy 
just talked about this scheme, remember what she did, right? She 
sets up this unique server arrangement. She alone controls it. On 
that server, on that email system are her personal emails, her 
work-related emails, Clinton Foundation information, and, now we 
know, classified information. This gets discovered. We find out this 
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arrangement exists. Then what happens? Her lawyers, her legal 
team decides which ones we get and which ones they get to keep. 
They made the sort on front end. And then we found out the ones 
that they kept and didn’t give to us, didn’t give to the American 
people, didn’t give to Congress, the ones they kept, they destroyed 
them. And you don’t have to take my word. I’ll take what you said 
on Tuesday. They deleted all emails that they did not return to the 
State Department, and the lawyers cleaned their devices in such a 
way as to preclude complete forensic recovery. Now, that sounds 
like a fancy way of saying they hid the evidence, right? And you 
just told Mr. Gowdy thousands of emails fell into those categories. 
Now, that seems to me to provide some context to what took place 
here. 

Did Secretary Clinton’s legal team — excuse me. Let me ask it 
this way. Did Secretary Clinton know her legal team deleted those 
emails that they kept from us? 

Mr. CoMEY. I don’t believe so. 

Mr. Jordan. Did Secretary Clinton approve those emails being 
deleted? 

Mr. CoMEY. I don’t think there was any specific instruction or 
conversation between the Secretary and her lawyers about that. 

Mr. Jordan. Did you ask that question? 

Mr. CoMEY. Yes. 

Mr. Jordan. Did Secretary Clinton know that her lawyers 
cleaned devices in such a way as to preclude complete forensic re- 
covery? 

Mr. CoMEY. I don’t believe that she did. 

Mr. Jordan. Did you ask that question? 

Mr. CoMEY. Yes. 

Mr. Jordan. Do you see how someone could view the context of 
what she did? Set up a private system. She alone controlled it. She 
kept everything on it. We now know from Ms. Abedin’s deposition 
that they did it for that very reason, so no one could see what was 
there, based on the deposition Ms. Abedin gave. And then when 
they got caught, they deleted what they had and they scrubbed 
their devices. 

Is that part of the context in evaluating this decision? 

Mr. CoMEY. Sure. Sure. And understand what inferences can be 
drawn from that collection of facts, of course. 

Mr. Jordan. All right. 

Mr. Chairman, I yield back. 

Chairman Chaffetz. I thank the gentleman. 

I’ll now recognize the gentlewoman from the District of Colum- 
bia, Ms. Norton, for 5 minutes. 

Ms. Norton. Thank you, Mr. Chairman. 

Director Comey, I appreciate your conduct of this investigation in 
a nonpartisan way, in keeping with the sterling reputation, which 
has led Presidents of both parties to appoint you to highly placed 
law enforcement positions in our Federal Government. 

I want to say for the record that this hearing, where you call the 
prosecutor — and Mr. Comey stands in the place of the prosecutor, 
because the Attorney General has accepted entirely the FBI’s rec- 
ommendations — where you call the prosecutor to give account for 
the decision to prosecute or not a particular individual raises seri- 
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ous questions of separation of powers. And, particularly, when 
you’re questioning the prosecutor’s decision with respect to the de- 
cision to prosecute or not a particular individual, it raises serious 
bill of attainder constitutional questions. 

These hearings are so often accusatory that they yield no guid- 
ance as to how to conduct business in the future, and that’s the 
way it looks. It looks as though that is how this hearing is going. 

Now, of course, now, everyone understands in the abstract why 
it is important for security reasons to use official government 
mail — or email rather than private accounts — private email if secu- 
rity matters are involved. Now, that’s a very broad, wide propo- 
sition. 

Now, there are no rules, so far as I know, requiring Members of 
Congress to use their — as to how they use their official email ac- 
counts, whether involving security or not. The chairman of this 
committee lists his personal account, for example, on his business 
card. I’m — no one says that’s wrong. I don’t know if it’s wrong or 
right, because there’s no guidance. Federal agency employees. 
Members of Congress often have secure information or at least sen- 
sitive information that shouldn’t be made public. Some of our Mem- 
bers are on the Intelligence Committee or the defense committee or 
even this committee and may have such matters. Some of these 
matters may concern national security issues, and — I don’t know — 
if something as sensitive as the itinerary if you’re going on a codel 
as to the route you are taking and where you will be, all of that 
could be on people’s personal emails. 

Of course, this is the legislative branch, and I spoke of the sepa- 
ration of powers, and I’m not indicating that there should be a gov- 
ernmentwide sense that is ordained from on high, but there ought 
to be rules that everybody understands, especially after the Clinton 
episode, about the use of personal email. So I’d like your insight 
for guidance as far as other Federal employees are concerned or 
even Members of Congress and their staff, because I think we could 
learn from this episode. 

So, strictly from a security standpoint, do you believe that Fed- 
eral employees, staff, even Members of Congress, should attempt 
guidance on the issue of the use of personal emails versus some of- 
ficial form of communication? What should we learn from the proc- 
ess the Secretary has gone through? I’m sure there will be ques- 
tions about how there was even confusion, for example, in the State 
Department, but what should we learn when it comes to our own 
use of email or the use of Federal employees on this question? 

Mr. COMEY. Can I answer, Mr. Chairman? 

Chairman Chaffetz. Sure. 

Mr. Comfy. The most important thing to learn is that an unclas- 
sified email system is no case for an email conversation about clas- 
sified matters. And by that I mean either sending a document as 
an attachment over unclassified email that is classified or having 
a conversation about something that is a classified subject on an 
unclassified email system. That’s the focus of the concern. That’s 
the focus of this investigation. That it was also a personal email 
adds to the concern about the case because of the security 
vulnerabilities associated with a personal system, but the root of 
the problem is people using unclassified systems to conduct busi- 
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ness that is classified. And so all of us should have access to, if we 
have access to classified information, classified communication sys- 
tems. The FBI has three levels: unclassified system, a secret sys- 
tem, and a top secret system. You can email on all three, but you 
need to make sure you don’t email on the unclass system, even if 
that’s a government classified system, about matters that are clas- 
sified. That’s the important lesson learned. Everybody ought to be 
aware of it. Everybody ought to be trained on it. We spend a lot 
of time training on it in the FBI to make sure folks are sensitive 
to the need to move a classified discussion, even if it doesn’t involve 
sending a document, to the appropriate forum. 

Ms. Norton. Members of Congress included? 

Mr. CoMEY. Of course. 

Ms. Norton. Thank you, Mr. Chairman. 

Chairman Chaffetz. We’ll now recognize the gentleman from 
Florida, Mr. DeSantis, for 5 minutes. 

Mr. DeSantis. Director, and the reason why that’s so important 
is because if top secret information is compromised, that could 
damage our national security, correct? 

Mr. COMEY. Yes, by definition. 

Mr. DeSantis. And American lives are at stake in some in- 
stances, correct? 

Mr. CoMEY. Yes. 

Mr. DeSantis. You mentioned a lot of people were upset that 
there were no consequences for Secretary Clinton, but in your 
statement, you did point out that administrative and security con- 
sequences would be appropriate if someone demonstrated extreme 
carelessness for classified information. 

So those consequences, that would include potentially termi- 
nation of Federal employment? 

Mr. CoMEY. Correct. 

Mr. DeSantis. It could include revocation of security clearance? 

Mr. CoMEY. Yes. 

Mr. DeSantis. And it could include ineligibility for future em- 
ployment in national security positions, correct? 

Mr. CoMEY. It could. 

Mr. DeSantis. Now, would you as the FBI Director allow some- 
one in the employ of your agency to work in a national security ca- 
pacity if that person had demonstrated extreme carelessness in 
handling top secret info? 

Mr. CoMEY. The best answer to that is we would look very close- 
ly at that in a suitability determination. It’s hard to answer in the 
abstract “yes” in all cases, “no” in all cases, but it would be a very 
important suitability scrub. 

Mr. DeSantis. So there would be instances where someone could 
be extremely careless but still maintain confidence? I mean, we 
have a lot of people who are very competent in this country who 
would love to work for your agency, but yet it would be — poten- 
tially you would allow somebody to be extremely careless and con- 
tinue on? 

Mr. COMEY. That’s the trouble with answering a hypothetical. I 
could imagine if it was a long time ago, and it was a small amount 
of conduct or something. That’s why it’s hard to say other than it 
would be a very important part of the 
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Mr. DeSantis. Let’s just put it this way. Would being extremely 
careless in handling top secret information expose an employee of 
the FBI to potential termination? 

Mr. COMEY. Yes. 

Mr. DeSantis. Why shouldn’t U.S. officials use mobile devices 
when traveling to foreign countries, especially if they’re discussing 
classified or sensitive information? 

Mr. CoMEY. Because the mobile device will transmit its signal 
across networks that are likely controlled or at least accessed by 
that hostile power. 

Mr. DeSantis. And that’s the guidance that the FBI gives all of- 
ficials when they’re traveling overseas. That’s still good guidance, 
correct? 

Mr. CoMEY. That’s good guidance. 

Mr. DeSantis. How did top secret information end up on the pri- 
vate server? Because your statement addressed Secretary Clinton. 
You did not address any of her aides in your statement. Attorney 
General Lynch exonerated everybody. That information just didn’t 
get there on its own, so how did it get there? Were you able to de- 
termine that? 

Mr. CoMEY. Yes. By people talking about a top secret subject in 
an email communication. 

Mr. DeSantis. So it was 

Mr. CoMEY. It’s not about forwarding a top secret document; it’s 
about having a conversation about a matter that is top secret. 

Mr. DeSantis. And those were things that were originated by 
Secretary Clinton’s aides and then sent to her, which would obvi- 
ously be in her server, but it was also included Secretary Clinton 
originating those emails, correct? 

Mr. COMEY. That’s correct. In most circumstances, it initiated 
with aides starting a conversation. In the one involving top secret 
information. Secretary Clinton, though, also not only received but 
also sent emails that talked about the same subject. 

Mr. DeSantis. And of that top secret information that you found, 
would somebody who was sophisticated in those matters, should it 
have been obvious to them that that was very sensitive informa- 
tion? 

Mr. CoMEY. Yes. 

Mr. DeSantis. So I guess my issue about knowledge of what 
you’re doing is in order for Secretary Clinton to have access to top 
secret/SCI information, didn’t she have to sign a form with the 
State Department acknowledging her duties and responsibilities 
under the law to safeguard this information? 

Mr. CoMEY. Yes. Anybody who gets access to SCI, sensitive com- 
partmented information, would sign what’s called a read-in form 
that lays that out. I’m sure Members of Congress have seen the 
same thing. 

Mr. DeSantis. And it stresses in that document and other train- 
ing people would get that there are certain requirements to han- 
dling certain levels of information. For example, a top secret docu- 
ment, that can’t even be on your secret system at the FBI, correct? 

Mr. CoMEY. Correct. 
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Mr. DeSantis. So you have to follow certain guidelines. And I 
guess my question is, is she’s a very sophisticated person. She did 
execute that document, correct? 

Mr. CoMEY. Yes. 

Mr. DeSantis. And her aides who were getting the classified in- 
formation, they executed similar documents to get a security clear- 
ance, correct? 

Mr. CoMEY. I believe so. 

Mr. DeSantis. And she knowingly clearly set up her own private 
server in order to — well, actually, let me ask you that. Was the rea- 
son she set up her own private server, in your judgment, because 
she wanted to shield communications from Congress and from the 
public? 

Mr. CoMEY. I can’t say that. Our best information is that she set 
it up as a matter of convenience. It was an already existing system 
that her husband had, and she decided to have a domain on that 
system. 

Mr. DeSantis. So the question is, is very sophisticated — this is 
information that clearly anybody who had knowledge of security in- 
formation would know that it would be classified — ^but I’m having 
a little bit of trouble to see, how would you not then know that that 
was something that was inappropriate to do? 

Mr. CoMEY. Well, I just want to take one of your assumptions 
about sophistication. I don’t think that our investigation estab- 
lished that she was actually particularly sophisticated with respect 
to classified information and the levels and the treatment, and so 
far as we can tell 

Mr. DeSantis. Isn’t she an original classification authority, 
though? 

Mr. CoMEY. Yes, sir. Yes, sir. 

Mr. DeSantis. Good grief. Well, I appreciate you coming. And I 
yield back the balance of my time. 

Chairman Chaffetz. I thank the gentleman. I ask unanimous 
consent to enter into the record two documents that Mr. DeSantis 
referred to. One is the Sensitive Compartmented Information Non- 
disclosure Agreement. The other one is the Classified Information 
Nondisclosure Agreement. Both signed by Hillary Rodham Clinton. 
Without objection, so ordered. 

Chairman Chaffetz. I now recognize the gentleman from Mis- 
souri, Mr. Clay, for 5 minutes. 

Mr. Clay. Thank you, Mr. Chairman. And thank you. Director 
Comey, for being here today and for the professionals whom you 
lead at the FBI. Two years ago after my urgent request to then- 
former Attorney General Eric Holder for an expedited Justice De- 
partment investigation into the tragic death of Michael Brown in 
Ferguson, Missouri, I witnessed firsthand the diligence, profes- 
sionalism, and absolute integrity of your investigators. And I have 
no doubt that was the case in this matter as well. I did not think 
it was possible for the majority to exceed their unprecedented arro- 
gant abuse of official channels and Federal funds that we have wit- 
nessed over the past 2 years as they have engaged in a partisan 
political witch hunt at taxpayer expense against Secretary Clinton. 

But I was wrong. This proceeding is just a sequel to that very 
bad act. And the taxpayers will get the bill. It is a new low, and 
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it violates both House rules and the rules of this committee. So 
with apologies to you and the FBI for this blatantly partisan pro- 
ceeding, let me return to the facts of this case as you have clearly 
outlined them. 

First question: Did Secretary Clinton or any member of her staff 
intentionally violate Federal law? 

Mr. CoMEY. We did not develop clear evidence of that. 

Mr. Clay. Did Secretary Clinton or any member of her staff at- 
tempt to obstruct your investigation? 

Mr. CoMEY. We did not develop evidence of that. 

Mr. Clay. In your opinion, do the mistakes Secretary Clinton has 
already apologized for and expressed regret for rise to a level that 
would be worthy of Federal prosecution? 

Mr. CoMEY. As I said Tuesday, our judgment, not just mine, but 
the team’s judgment at the FBI, is that the Justice Department 
would not bring such a case. No Justice Department under any — 
whether Republican or Democrat administration. 

Mr. Clay. Thank you for that response. I know the FBI pays par- 
ticular attention to groups by training agents and local law enforce- 
ment officers and participating in local hate crime working groups. 
Is that right? 

Mr. CoMEY. Yes, sir. 

Mr. Clay. Some of these organizations seem relatively harmless. 
But others appear to be very dangerous and growing. Some even 
promote genocide in their postings and rhetoric online. In your ex- 
perience, how dangerous are these groups and have they incited vi- 
olence in the past? 

Mr. CoMEY. I think too hard to answer. Congressman, in the ab- 
stract. There are some groups that are dangerous. There are some 
groups that are exercising important protection — protected speech 
under the First Amendment. 

Mr. Clay. Okay. Let me ask a more direct question. A gentleman 
named Andrew Anglin is the editor of a Web site called The Daily 
Stormer that is dedicated to the supremacy of the white race as 
well as attacking Jews, Muslims, and others. The Web site features 
numerous posts with the hashtag “white genocide” to protest what 
they contend is an effort to eliminate the white race. Are you famil- 
iar with this movement? 

Mr. COMEY. I’m not. 

Mr. Clay. Okay. Well, this hashtag has been promoted all over 
social media by a growing number of white supremacists. For ex- 
ample, one Nazi sympathizer tweeted repeatedly using the handle 
@whitegenocidetm. Are you concerned as some groups are increas- 
ing their followers in this way, particularly if some of those fol- 
lowers in this way, particularly if some of those followers could be- 
come violent? 

Mr. COMEY. I don’t know the particular enough to comment. Con- 
gressman. We are always concerned when people go beyond pro- 
tected speech, which we do not investigate, to moving towards acts 
of violence. And so our duty is to figure out when have people 
walked outside the First Amendment protection and are looking to 
kill folks or hurt folks. But I don’t know enough to comment on the 
particular. 
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Mr. Clay. I see. Well, one of my biggest concerns is that certain 
public figures are actually promoting these dangerous groups even 
further. And as you may know, one of our most vocal candidates 
for President retweeted @whitegenocidetm. Three weeks later, he 
did it again. Two days after that, he retweeted a different user 
whose image also included the term “white genocide,” and that’s 
not even all of them. Director Comey, don’t these actions make it 
easier for these racist groups to recruit even more supporters? 

Mr. Comey. I don’t think I’m in a position to answer that in an 
intelligent way sitting here. 

Mr. Clay. Well, I appreciate you trying. And thank you, Mr. Di- 
rector, for your exceptional and principled service to our country. 
I yield back. 

Chairman Chaffetz. Thank you. We’ll now recognize the gentle- 
woman from Wyoming, Mrs. Lummis, for 5 minutes. 

Mrs. Lummis. Welcome, Director. And thank you so much for 
being here. My phone has been ringing off the hook in my Wash- 
ington office, in my Wyoming office, from constituents who don’t 
understand how this conclusion was reached. So I appreciate your 
being here to help walk us through it. And here’s the issue that 
the people that are calling me from Wyoming are having. They 
have access to this statute. It’s Title 18 U.S. Code 1924. And I’m 
going to read you this statute. It says, “Whoever being an officer, 
employee, contractor, or consultant to the United States and by vir- 
tue of his office employment, position, or contract becomes pos- 
sessed of documents or materials containing classified information 
of the United States knowingly removes such documents or mate- 
rials without authority and with the intent to retain such docu- 
ments or materials at an unauthorized location shall be fined 
under this title or imprisoned for not more than one year or both.” 

Armed with that information, they’re wondering how Hillary 
Clinton, who is also an attorney, and attorneys are frequently held 
to a higher standard of knowledge of the law, how this could not 
have come to her attention. She was the Secretary of State. Of 
course, the Secretary of State is going to become possessed of clas- 
sified materials. Of course she was an attorney. She practiced with 
a prominent Arkansas law firm, the Rose Law Firm. She knew 
from her White House days with her husband, the President, that 
classified materials can be very dangerous if they get into the 
wrong hands. 

She had to have known about this statute because she had to 
have been briefed when she took over the job as the Secretary of 
State. So how, given that body of knowledge and experience, could 
this have happened in a way that could have potentially provided 
access by hackers to confidential information? 

Mr. Comey. No, it’s a good question, a reasonable question. The 
protection we have as Americans is that the government in gen- 
eral, and in that statute in particular, has to prove before they can 
prosecute any of us, that we did this thing that’s forbidden by the 
law, and that when we did it, we knew we were doing something 
that was unlawful. We don’t have to know the code number, but 
that we knew we were doing something that was unlawful. That’s 
the protection we have. And it’s one I’ve worked for very hard. 
When I was in the private sector, I did a lot of work with the 
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Chamber of Commerce to stop the criminalization of negligence in 
the United States. 

Mrs. Lummis. May I interrupt and suggest that this statute says 
“knowingly removes such documents or materials without authority 
and with the intent to retain such documents or materials at an 
unauthorized location.” The intent here in the statute is to retain 
the documents at an unauthorized location. It’s not intent to pass 
them on to a terrorist, or to someone out in Internetland. It’s just 
the intent to retain the documents or materials at an unauthorized 
location. 

Mr. CoMEY. It’s more than that, though. You’d have to show that 
and prove criminal intent, both by law, that’s the way the judge 
would instruct a jury, and practice at the Department of Justice. 
They have reserved that statute, even though it’s just a mis- 
demeanor, for people who clearly knew they were breaking the law. 
And that’s the challenge. So should have known, must have known, 
had to know, does not get you there. You must prove beyond a rea- 
sonable doubt that they knew they were engaged in something that 
was unlawful. 

Mrs. Lummis. Okay. Then 

Mr. CoMEY. That’s the challenge. 

Mrs. Lummis. Then may I turn to her attorneys. Did all of Sec- 
retary Clinton’s attorneys have the requisite clearances at the time 
they received all of her emails, especially those that were classified 
at the time they were sent? 

Mr. CoMEY. No. 

Mrs. Lummis. They destroyed, as has been noted, 30,000 emails 
of Secretary Clinton’s. Do you have 100 percent confidence that 
none of the 30,000 emails destroyed by Secretary Clinton’s attor- 
neys was marked as classified? 

Mr. CoMEY. I don’t have 100 percent confidence. I’m reasonably 
confident some of them were classified. There were only three in 
the entire batch we found that bore any markings that indicated 
they were classified. So that’s less likely. But surely, it’s a reason- 
able assumption that some of the ones they deleted contained clas- 
sified information. 

Mr. Blum. Thank you. Director. Thank you, Mr. Chairman. I 
yield back. 

Chairman Chaefetz. I now recognize the gentleman from Massa- 
chusetts, Mr. Lynch, for 5 minutes. 

Mr. Lynch. Thank you, Mr. Chairman. Thank you. Director 
Comey, for appearing here to help the committee with its work. Di- 
rector Comey, Secretary Clinton’s certainly not the only Secretary 
of State to use a personal email account with information later 
identified as being classified. I just want to show you. This is a 
book that was written by former Secretary of State Colin Powell. 
And in his book, he says, “To complement the official State Depart- 
ment computer in my office, I installed a laptop computer and on 
a private line. My personal email account on a laptop allowed me 
direct access to anyone online. So I started shooting emails to my 
principal assistants, to individual ambassadors, and increasingly, 
to my foreign minister colleagues who like me were trying to bring 
their ministries into the one 186,000 miles per second world.” Were 
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you aware of this, that Secretary Colin Powell actually had a pri- 
vate server as well? 

Mr. CoMEY. Not a private server. I think he used a commercial 
email account for State Department business. 

Mr. Lynch. Private line, unprotected. 

Mr. CoMEY. Correct. Not a State Department email system. 

Mr. Lynch. Right. Right. He went rogue, so to speak. Right? 

Mr. COMEY. I don’t know whether I’d say that. 

Mr. Lynch. Yeah. All right. Okay. I’m not going to put words in 
your mouth. But do you think this was careless for him to do that, 
just to start — ^you know, get his own — he got his own system. He 
installed a laptop computer on a private line. “My personal email 
account was on a laptop and allowed me direct access to anyone, 
anyone online.” That’s his own statement. I’m just trying to com- 
pare Secretaries of State, because Secretary Powell’s never been 
here. As a matter of fact, when we asked him for his emails, unlike 
the 55,000 that we received from Secretary Clinton, he said, “I 
don’t have any to turn over.” This is a quote. This was on ABC’s 
This Week. He explained, “I don’t have anything to turn over. I 
didn’t keep a cache of them. I did not print them off. I do not have 
thousands of pages somewhere on my personal files.” But he was 
Secretary of State, and he operated, you know, on a private system. 
Were you aware of that? 

Mr. CoMEY. Not at the time 15 years ago. But I am now. 

Mr. Lynch. Yeah. Okay. So recently — well, back in October 2015, 
the State Department sent Secretary Powell a letter requesting 
that he contact his email provider, AOL, to determine whether any 
of his emails are still on the unclassified systems. Are you aware 
of that ongoing investigation? 

Mr. COMEY. I don’t know of an investigation. I am 

Mr. Lynch. Well, that request for information from former Sec- 
retary Powell. 

Mr. CoMEY. Yes, I am. 

Mr. Lynch. You’re aware of that. Are you surprised that he has 
never responded? 

Mr. COMEY. I don’t know enough to comment. I don’t know ex- 
actly what conversation he had with the State Department. 

Mr. Lynch. All right. I’m trying to look at the — you know, where 
we have a lot of comparisons in other cases. And there seems, like 
all the cases where prosecutions have gone forward, the subject of 
the investigation has demonstrated a clear intent to deliver classi- 
fied information to a person or persons who were unauthorized to 
receive that. So if you look at the, you know, PFC Bradley Man- 
ning, now Chelsea Manning, that was a court martial. But he dem- 
onstrated a clear intent to publish that information, which was 
classified. Julian Assange, the WikiLeaks editor, I guess, and pub- 
lisher. 

Again, a wide and deliberate attempt to publish classified infor- 
mation. General Petraeus, which we talked about earlier today, 
shared information with his biographer. And Jeffrey Sterling send- 
ing stuff to The New York Times. Former CIA officer Kiriakou, who 
was interested in writing a book, so he hung on to his information. 
And even former Director of the CIA, John Deutch, who retained 
classified information on a couple of servers, one in Belmont, Mas- 
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sachusetts, and one in Bethesda, Maryland. And that was after he 
became a private citizen. 

So in all those cases, there’s a clear intent. As you said before, 
you look at what people did and what they were thinking when 
they did that. And I would just ask you: Is there a clear distinction 
between what those people did and what Secretary Clinton did in 
her case? 

Mr. COMEY. In my view, yes. The Deutch case illustrates it per- 
fectly. And he took huge amount of documents, almost all at the 
TS/SCI level, had them in hard copy at his house, had them on an 
unclassed system connected to the Internet, attempted to destroy 
some of them when he got caught. Admitted: I knew I wasn’t sup- 
posed to be doing this. So you have clear intent, huge amounts of 
documents, obstruction of justice, those are the kinds of cases that 
get prosecuted. That’s what I said when — I meant it when I said 
it. In my experience, which is three decades, no reasonable pros- 
ecutor would bring this case. I know that frustrates people. But 
that’s the way the law is. And that’s the way the practice is at the 
Department of Justice. 

Mr. Lynch. Thank you for your testimony and for your service. 
I yield back. 

Chairman Chaffetz. Thank you gentleman. 

We’ll now go to the gentleman from North Carolina, Mr. Mead- 
ows, for 5 minutes. 

Mr. Meadows. Thank you, Mr. Chairman. Director Comey, 
thank you. There has been much said today about criticizing you 
and your service. And I want to go on record that even though 
many of my constituents would love for me to criticize your service 
because of the conclusion you reached, never have I, nor will I, 
criticize your service. And we appreciate your service to this coun- 
try and the integrity. So I’m going to focus on the things that you 
said, not the conclusion that you drew. 

And Congressman Trey Gowdy and I talked a little bit about 
this, but on February 4, 2016, Secretary Clinton, during a presi- 
dential debate said, “I never sent or received any classified mate- 
rial. They are retroactively classifying it,” closed quote. And so in 
your statement on July 5, you said that there were indeed 110 
emails, 52 email chains, which there was classified information on 
it at the time it was sent or received. So those two statements, both 
of them cannot be true. Is that correct? Your statement and her 
statement? 

Mr. Comey. Yeah. It’s not accurate to say that she did not send 
or receive 

Mr. Meadows. So she did not tell the truth during that presi- 
dential debate that she never sent or received classified informa- 
tion, and it was retroactively classified? 

Mr. Comey. Yeah. I don’t think that’s a question I should be an- 
swering what was in her head 

Mr. Meadows. Well, either your statement’s not true or hers is 
not true. Both of them cannot be true. So is your statement true? 

Mr. Comey. That I can speak to. My 

Mr. Meadows. Okay. Your statement is true. So the American 
people will have to judge with her statement not being true. So let 
me go on to another one. On October 22 she said, “There was noth- 
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ing marked classified on emails either sent or received.” And in 
your statement you said, “A very small number of emails contained 
classified information bore markings indicating the presence of 
classified information at the time.” So she makes a statement that 
says there was no markings. You make a statement that there was. 
So her statement was not true. 

Mr. CoMEY. Well, that one actually I have a little bit of insight 
into her statement, because we asked her about that. There were 
three documents that bore portion markings where you’re obli- 
gated, when something is classified, to put a marking on that para- 
graph. 

Mr. Meadows. Right. 

Mr. CoMEY. And there were three that bore C in parens, which 
means that’s confidential classified 

Mr. Meadows. So a reasonable person who has been a Senator, 
a Secretary of State, a First Lady, wouldn’t a reasonable person 
know that that was a classified marking as a Secretary of State? 

Mr. CoMEY. Yeah. 

Mr. Meadows. A reasonable person. That’s all I’m asking. 

Mr. CoMEY. Yeah. Before this investigation I probably would 
have said yes. I’m not so sure. I don’t find it incredible 

Mr. Meadows. Director Comey, come on. I mean. I’ve only been 
here a few years, and I understand the importance of those mark- 
ings. So you’re suggesting that a long length of time that she had 
no idea what a classified marking would be? That’s your sworn tes- 
timony today? 

Mr. Comey. No, no, not that she would have no idea what a clas- 
sified marking would be. But it’s an interesting question as to 
whether she — this question about sophistication came up earlier. 
Whether she was actually sophisticated enough to understand what 
a C in parens mean. 

Mr. Meadows. So you’re saying this former Secretary of State is 
not sophisticated enough to understand a classified marking. 

Mr. Comey. No. That’s not what I’m saying. 

Mr. Meadows. That’s a huge statement. 

Mr. Comey. That’s not what I’m saying. You asked me did I as- 
sume that someone would know. Probably before this investigation, 
I would have. I’m not so sure of that answer any longer. I think 
it’s possible, possible, that she didn’t understand what a C meant 
when she saw it in the body of an email like that. 

Mr. Meadows. After years in the Senate, and Secretary of State? 
I mean, that’s hard for me and the American people to believe. Di- 
rector Comey. And I’m not questioning your analysis of it, but 
wouldn’t a reasonable person think that someone who has the high- 
est job of handling classified information understand that? 

Mr. Comey. I think that’s a conclusion a reasonable person 
would draw. It may not be accurate. 

Mr. Meadows. So in that, let me go a little bit further. Because 
that last quote actually came on October 22 , 2015, under sworn tes- 
timony before the Benghazi Committee. So if she gave sworn testi- 
mony that a reasonable person would suggest was not truthful, 
isn’t it a logical assumption that she may have misled Congress, 
and we need to look at that further? 
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Mr. CoMEY. Well, the reasonable person test is not what you look 
at for perjury or false statements. But like I said, I can understand 
why people would ask that question. 

Mr. Meadows. All right. So let me, in the last little portion of 
this, in your 3-1/2 hour interview on Saturday, did she contradict 
some of these public statements in private? Because you said she 
didn’t lie to the FBI. But it’s apparent that she lied to the Amer- 
ican people. So did she change her statements in that sworn testi- 
mony with you last Saturday? 

Mr. CoMEY. I haven’t gone through that to parse that. I have 

Mr. Meadows. Can you do that and get back to this committee? 
Because it’s important, I think, to the American people and to 
transparency. 

Mr. CoMEY. I’m sure. And as the chairman and I have talked 
about. I’m sure the committee’s going to want to see documents in 
our investigation and whatnot, and we’ll work to give you whatever 
we can possibly give you under our law. But I haven’t done that 
analysis at this point. 

Mr. Meadows. Will you, and get that back to us? 

Chairman Chaffetz. The gentleman’s time has expired. And 
we’ll now recognize the gentleman from Tennessee, Mr. Cooper, for 
5 minutes. 

Mr. Cooper. Thank you, Mr. Chairman. And thank you. Director 
Comey. I hate to see one of America’s most distinguished public 
servants pilloried before this committee. We’re all highly partisan 
here. We’re good back seat drivers. We’re all today apparently arm- 
chair prosecutors. And you stated the truth when you said that you 
didn’t know of anyone who would bring a case like this. And some 
of the prosecutors have had decades to do that. I hope that this 
committee’s effort is not intended to intimidate you or the FBI or 
law enforcement in general, or government employees. 

And I’m thankful at this moment that you have such a lifetime 
record of speaking truth to power. Because that’s very important. 
It’s also very important that apparently you’re a lifelong Repub- 
lican. You’re just here to do your job, to state the facts. I think the 
key issue here is whether, in fact, there’s a double standard, where 
some Americans are being treated differently than others. And I 
think I can rely on my Republican colleagues to make sure that 
Hillary Clinton’s treated no better than anybody else. There should 
be some attention given to make sure that she’s not treated any 
worse than anybody else. 

I think we all know that we wouldn’t be having this hearing, es- 
pecially on an emergency basis, unless she were running for Presi- 
dent. My colleague from Massachusetts has just pointed out that 
previous Secretaries of State are not being called on the carpet, 
whether that be Condoleezza Rice or Colin Powell or others. 

But I think the grossest double standard here today is the fact 
that all the members of this committee, every Member of Congress, 
is not subject to the same law that Secretary Clinton was subject 
to. And as lawmakers, that means that we have exempted our- 
selves from the standard of other Federal employees. My colleague 
from D.C., Ms. Norton, referred to this. Why did we exempt our- 
selves from the same rules? Apparently our chairman lists his pri- 
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vate email account on his business card. We all have access to clas- 
sified information. 

So I would like to challenge my Republican colleagues here 
today. Let’s work together and introduce legislation to make the 
same laws apply to us as apply to the executive branch and to Sec- 
retary Clinton. I would be happy to join in such legislation to make 
sure that we’re not being hypocritical on this panel, that we’re 
holding ourselves to the same standards as Secretary Clinton, and 
not trying to accuse her of things that we may be guilty of our- 
selves. 

I bet my colleagues would be the first to complain if, for example, 
emails were retroactively classified. That’s a situation that most 
people in public service would object to pretty strongly. How did 
you know at the time if you had no idea? So I think it’s very impor- 
tant if we want as Congress to have the trust of the American peo- 
ple to not be hypocritical, to uphold the same standards that we 
want to see upheld by others, and I’m just thankful at this moment 
in our history that we have someone like you who’s in charge of 
the FBI. Because too many things are highly politicized. And the 
last thing we should do is criminalize our political system. 

I didn’t see any of my Republican colleagues complain when 
former Governor Bob McDonald was exonerated by an 8-0 vote at 
the Supreme Court for having done certain things that I think 
most Americans would find highly objectionable. But our court, on 
a bipartisan, unanimous basis, exonerated him just a week or two 
ago. 

So I think this is a moment for committee members to reflect, to 
take a deep breath, to calm down and realize exactly what you 
said, that no reasonable prosecutor would have brought this case. 
And thank you for stating that so clearly and publicly. I yield back 
the balance of my time. 

Mr. Cummings. Will the gentleman yield? 

Mr. COMEY. I yield to the ranking member. 

Mr. Cummings. Mr. Director, let me ask you this: First of all, I 
associate myself with everything the gentleman just said. You were 
talking about some markings a little bit earlier. Is that right? Can 
you describe what those markings are like? Markings on docu- 
ments. I think you said there were three documents with certain 
markings on them 

Mr. CoMEY. Yeah. 

Mr. Cummings. — that indicated classified. Go ahead. 

Mr. CoMEY. Yeah, there were three emails that down in the body 
of the email, in the three different emails, there were paragraphs 
that, at the beginning of the paragraph, had a parenthesis, a cap- 
ital C, and then a parenthesis. And that is a portion marking to 
indicate that 

Mr. Cummings. That paragraph. 

Mr. CoMEY. — that paragraph is classified at the confidential 
level, which is the lowest level of classification. 

Mr. Cummings. And so out of the 30,000 documents, you found 
these three markings? Is that what you’re saying? 

Mr. COMEY. Three emails for C markings down in the body. None 
of the emails had headers, which is at the top of a document that 
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says it’s classified. Three had within the body the portion marking 
for C. 

Mr. Cummings. Thank you. 

Chairman Chaffetz. Thank the gentleman. I now recognize the 
gentleman from Tennessee, Mr. Duncan, for 5 minutes. 

Mr. Duncan. Thank you, Mr. Chairman. Mr. Meadows men- 
tioned one instance in which Secretary Clinton said that she did 
not mail any classified material to anyone. Actually, she said that 
several other times. But it is accurate. Director Comey, that you 
found at least 110 instances of when she had emailed classified ma- 
terial? 

Mr. Comey. 110 that she either received or sent. 

Mr. Duncan. Right. And it also is accurate that, quote, “Clinton’s 
lawyers cleaned their devices in such a way as to preclude complete 
forensic recovery”? 

Mr. Comey. Correct. 

Mr. Duncan. And also when she said — when Secretary Clinton 
said that nothing she sent was marked classified, and you said, in 
your press conference, “but even if information is not marked clas- 
sified in an email, particularly are participants who know or should 
know that the subject matter’s classified are still obligated to pro- 
tect it.” Do you feel that Secretary Clinton knew, or should have 
known, that she was obligated to protect classified information? 

Mr. Comey. Yes. 

Mr. Duncan. With her legal background and her long experience 
in government. Also, she said at one point that she has directed all 
emails, work-related emails, to be forwarded to the State Depart- 
ment. Is it also accurate that you discovered thousands of other 
emails that were work-related other than the 30,000 that she sub- 
mitted? 

Mr. Comey. Correct. 

Mr. Duncan. Before I came to Congress, I spent several years as 
a criminal court judge. I presided over several hundred felony 
criminal cases. And I can assure you that I saw many cases where 
the evidence of criminal intent was flimsier than the evidence in 
this case. But do you realize that great numbers of people across 
this country felt that you presented such an incriminating case 
against Secretary Clinton in your press conference that they were 
very surprised or even shocked when you reached the conclusion to 
let her off? You doubt that great numbers feel that way? 

Mr. Comey. No. I think so. And I understand the question. And 
I wanted to be as transparent as possible. We went at this very 
hard to see if we could make a case. And I wanted the American 
people to see what I honestly believed about the whole thing. 

Mr. Duncan. Well, do you understand, as the chairman said ear- 
lier, that great numbers of people feel now that there’s a one stand- 
ard of justice for the Clintons and another for regular people? 

Mr. Comey. Yeah, I’ve heard that a lot. It’s not true, but I’ve 
heard it a lot. 

Mr. Duncan. Well, even the ranking member who was here, who, 
of course as we understand, had to defend Secretary Clinton as 
strongly as possible, he almost begged you to explain the gap be- 
tween the incriminating case that you presented and the conclusion 
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that was reached. Did that surprise you that he felt so strongly 
that there was this big gap? 

Mr. CoMEY. No. Not at all. These — it’s a complicated matter. It 
involves understanding how the Department of Justice works 
across decades, house prosecutorial discretion is exercised. I get 
that folks see disconnection, especially when they see a statute that 
says “gross negligence.” Well, the Director just said she was ex- 
tremely careless. So how is that not prosecutable? So it takes an 
understanding of what’s one on over the last 99 years. What’s the 
precedent? How do we treat these cases. I totally get people’s ques- 
tions. And I think they’re in good faith. 

Mr. Duncan. We talked about gross negligence here. And you 
said that Secretary Clinton was extremely careless with this classi- 
fied material, and how dangerous it could be, how threatening, 
even to people’s lives that it could be to disclose classified material. 
Do you agree that there is a very thin line between gross neg- 
ligence and extreme carelessness? And would you explain to me 
what you consider to be that difference? 

Mr. CoMEY. Sure, Judge — Congressman. As a former judge, you 
know there isn’t actually a great definition in the law of gross neg- 
ligence. Some courts interpret it as close to willful, which means 
you know you’re doing something wrong. Others drop it lower. My 
term extremely careless is — I’m trying to be kind of an ordinary 
person. That’s a commonsense way of describing it sure looks real 
careless to me. The question of whether that amounts to gross neg- 
ligence, frankly, is really not at the center of this, because when 
I look at the history of the prosecutions and see it’s been one case 
brought on a gross negligence theory, I know from 30 years, there’s 
no way anybody at the Department of Justice is bringing a case 
against John Doe or Hillary Clinton for the second time in 100 
years based on those facts. 

Mr. Duncan. You ended your statement to Congressman Cooper 
a while ago saying once again that no reasonable prosecutor could 
have brought this case. Yet you also mentioned earlier today that 
you’d seen several of your friends and other prosecutors who’ve 
said publicly, many across this country, that they would have been 
glad to prosecute this case. 

Mr. CoMEY. I smile because they’re friends. And I haven’t talked 
to them. And I want to say: Guys, so where were you over the last 
40 years? Where were these cases? They just have not been 
brought. For reasons that I said earlier, it’s a good thing that the 
Department of Justice worries about prosecuting people for being 
careless. I don’t like it. As a citizen I want people to show they 
knew they were breaking the law, and then we’ll put you in jail. 

Mr. Duncan. Of course, you know many people have been pros- 
ecuted for gross negligence by the Federal Government, by the FBI. 

Chairman Chaffetz. The gentleman’s time has expired. 

Mr. Duncan. Thank you. 

Chairman Chaffetz. We’ll now recognize the gentleman from 
Virginia, Mr. Connolly, for 5 minutes. 

Mr. Connolly. Thank you. And welcome. Director Comey. And 
although our politics are different, I gather you’re a Republican. Is 
that correct? 
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Mr. CoMEY. I have been a registered Republican for most of my 
adult life. I’m not registered any longer. 

Mr. Connolly. We don’t register by party in Virginia. But many 
have suspected my politics as being Democratic. And I thank you 
for your integrity. As my colleague said, and I said in my opening 
statement, your career has been characterized as speaking truth to 
power. And you’re doing it again today. Just to set the context. Di- 
rector Comey, not that you’re unaware of this. 

Today’s hearing is political theatre. There’s not even the pretense 
of trying to get at the truth. This is a desperate attempt under an 
extraordinary set of circumstances, an emergency hearing. I don’t 
know what the emergency is other than one side is about to nomi- 
nate somebody who is a pathological narcissist who, you know, is 
talking about banning Muslims and Mexicans crossing the border 
who are all rapists and women who are pigs and terrified at the 
prospect of the consequences of that in the election. So let’s grab 
onto whatever we can to discredit or try to discredit the other 
nominee, punitive nominee. And you took away their only hope. 

And so the theater today is actually trying to discredit you. Sub- 
tlety in some cases. My friend from South Carolina uses big words 
like “exculpatory.” And kind of goes through what a prosecutor 
would do. The insinuation being you didn’t do your job. My friend 
from Wyoming is apparently flooded with citizens in her home 
State who are reading the statute that governs classification. Lot 
of time on their hands back there, I guess. But, yeah, this is all 
designed to discredit your finding. Now, the FBI interviewed Sec- 
retary Clinton. Is that correct? 

Mr. Comey. Yes. 

Mr. Connolly. Did she lie to the FBI in that interview? 

Mr. Comey. I have no basis for concluding that she was untruth- 
ful with us. 

Mr. Connolly. And is it a crime to lie to the FBI? 

Mr. Comey. Yes, it is. 

Mr. Connolly. David Petraeus did lie to the FBI. 

Mr. Comey. Yes. 

Mr. Connolly. And he prosecuted for that — well, could have 
been. 

Mr. Comey. Could have been, was not for that 

Mr. Connolly. Right. That’s always a judgment call. 

Mr. Comey. Correct. 

Mr. Connolly. Was she evasive? 

Mr. Comey. I don’t think the agents assessed she was evasive. 

Mr. Connolly. How many emails are we talking about, total 
universe, that were examined by your team? 

Mr. Comey. Tens of thousands. 

Mr. Connolly. Tens of thousands. And how many are in a ques- 
tionable category that maybe could have, should have been looked 
at more carefully because there could be some element of classifica- 
tion? Apparently, my friend from North Carolina assumes we’re all 
intimately familiar with the fact that if a C appears, it means a 
classification, though there seems to be some dispute about that be- 
cause the State Department, as I understand it, has actually said 
some of those were improperly marked and shouldn’t have had the 
C. Are you aware of that? 
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Mr. COMEY. Yes. 

Mr. Connolly. Yes. So could it be that in her 100-trip, 4 years — 
100 overseas trips to 100 countries as Secretary of State trying to 
restore U.S. credibility that had been destroyed in the previous 8 
years overseas, and tens of thousands of email communications, not 
including phone calls and classified conversations in SCIFs and the 
like, that maybe the small percentage of emails, she didn’t pay as 
much attention to them as maybe in retrospect one would hope she 
would have. Is that a fair conclusion? Could that be a fair conclu- 
sion? 

Mr. CoMEY. I don’t usually deal in maybes. It’s possible. 

Mr. Connolly. Well, you do deal in distinguishing between will- 
ful and inadvertent. 

Mr. CoMEY. Sure. 

Mr. Connolly. And in this case, you concluded it has to be in 
the latter category. It wasn’t willful. 

Mr. CoMEY. We concluded there was not adequate evidence of 
willful conduct. 

Mr. Connolly. Right. So there’s no obfuscation here, unlike the 
Petraeus case. And there’s no evasion. There’s no lying. There’s no 
willful intent to compromise classified material, despite the insinu- 
ations of my friends on the other side of the aisle. And the only 
hope left in this political theatre is to discredit you and your team 
in the hopes that, therefore, you won’t have credibility and we can 
revisit this monstrous crime of using a private server, that server 
being the server of the former President of the United States that 
maybe Mrs. Clinton thought would be more secure than the leaky 
system at the State Department. I yield back. 

Chairman Chaffetz. We now recognize the gentleman from 
Texas, Mr. Hurd, for 5 minutes. 

Mr. Hurd. Thank you, Mr. Chairman. Mr. Chairman, I’m of- 
fended. I’m offended by my friends on the other side of the political 
aisle saying this is political theatre. This is not political theatre. 
For me, this is serious. I spent 9-1/2 years as an undercover officer 
in the CIA. I was the guy in the back alleys collecting intelligence, 
passing it to lawmakers. I’ve seen my friends killed. I’ve seen as- 
sets put themselves in harm’s way. And this is about protecting in- 
formation, the most sensitive information the American govern- 
ment has. And I wish my colleagues would take this a little bit 
more seriously. 

Mr. Comey, Director Comey, excuse me, SAP, Special Access Pro- 
gram. You alluded to earlier that includes SCI information. Does 
SCI information include HUMINT and SIGINT? 

Mr. Comey. Yes. 

Mr. Hurd. HUMINT and SIGINT. Human intelligence informa- 
tion collected from people that are putting themselves in harm’s 
way to give us information to drive foreign policy. Signals intel- 
ligence. Some of the most sensitive things to understand; what A1 
Qaeda is doing; what ISIS is doing. So the former Secretary of 
State had an unauthorized server, those are your words, in her 
basement, correct? 

Mr. Comey. Correct. 

Mr. Hurd. Who was protecting that information? Who was pro- 
tecting that server? 
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Mr. CoMEY. Well, not much. There was a number of different 
people who were assigned as administrators of the server. 

Mr. Hurd. And at least seven email chains, or eight that was 
classified as TS/SCI. 

Mr. CoMEY. Correct. 

Mr. Hurd. So the former Secretary of State, one of the Presi- 
dent’s most important advisors on foreign policy and national secu- 
rity, had a server in her basement that had information that was 
collected from our most sensitive assets, and it was not protected 
by anyone? And that’s not a crime? That’s outrageous. People are 
concerned. What does it take for someone to misuse classified infor- 
mation and get in trouble for it? 

Mr. COMEY. Well, it takes mishandling it and criminal intent. 

Mr. Hurd. And so an unauthorized server in the basement is not 
mishandling? 

Mr. CoMEY. Well, no, there is evidence of mishandling here. This 
whole investigation at the end focused on is there sufficient evi- 
dence of intent. 

Mr. Hurd. Was this unanimous opinion within the FBI on your 
decision? 

Mr. CoMEY. Well, the whole FBI wasn’t involved, but the team 
of agents, investigators, analysts, technologists, yes. 

Mr. Hurd. Did you take into any consideration the impact that 
this precedence can set on our ability to collect intelligence over- 
seas? 

Mr. COMEY. Yes. My primary concern is the impact on what 
other employees might think in the Federal Government. 

Mr. Hurd. And you don’t think this sends a message to other 
employees that if a former Secretary of State can have an unau- 
thorized server in their basement that transmits top secret infor- 
mation, that that’s not a problem? 

Mr. COMEY. Oh, I worry very much about that. That’s why I 
talked about that in my statement, because an FBI employee might 
face severe discipline. And I want them to understand that those 
consequences are still going to be there. 

Mr. Hurd. Director Comey, do you have a server in your base- 
ment? 

Mr. Comey. I do not. 

Mr. Hurd. Does anybody in the FBI have a server in their base- 
ment or in their house? 

Mr. Comey. I don’t know. 

Mr. Hurd. Do you think it’s likely? 

Mr. Comey. I think it’s unlikely. 

Mr. Hurd. I would think so, too. I would think so, too. Because 
I’ve always been proud to serve alongside the men and women that 
you represent. So there was no dissenting opinion when you made 
this decision. It’s your job to be involved in counterintelligence as 
well? 

Mr. Comey. Yes. 

Mr. Hurd. So that means protecting our secrets from foreign ad- 
versaries collecting them. Is that correct? 

Mr. Comey. Correct. 

Mr. Hurd. Did this activity you investigated make America’s se- 
crets vulnerable to hostile elements? 
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Mr. COMEY. Yes. 

Mr. Hurd. Do you think that pattern of behavior would con- 
tinue? 

Mr. COMEY. I’m sorry? 

Mr. Hurd. Do you think that pattern of behavior would con- 
tinue? 

Mr. COMEY. Would continue? 

Mr. Hurd. By our former Secretary of State. 

Mr. COMEY. I’m not following you. You mean if we hadn’t — if this 
had not come to light, you mean? 

Mr. Hurd. Right now, based on what we see, do you think there’s 
going to be other elements within the Federal Government that 
think it’s okay to have an unauthorized server in their basement? 

Mr. CoMEY. Well, they better not. That’s one of the reasons I’m 
talking about 

Mr. Hurd. So, but what is the ramifications of them doing that? 
You know, how is there going to be any consequences levered if it’s 
not being levered here? Because, indeed, you’re setting a precedent. 

Mr. CoMEY. Yeah. The precedent — I want people to understand, 
again, I only am responsible for the FBI, that there will be dis- 
cipline from termination to reprimand and everything in between 
for people who mishandle classified information. 

Mr. Hurd. Director Comey, I’m not a lawyer, and so I may mis- 
state this. Is there such a thing as the case of first impression? And 
why was this not possibly one of those? 

Mr. Comey. There is such a thing, which just means the first 
time you do something. The reason this isn’t one of those is that’s 
just not fair. That would be treating somebody differently because 
of their celebrity status, or because of some other factor doesn’t 
matter. We have to treat people — the bedrock of our system of jus- 
tice, we treat people fairly. We treat them the same based on 
their 

Mr. Hurd. And that person mishandling the most sensitive infor- 
mation that this government can collect is not fair — it’s not fair to 
punish someone who did that? 

Mr. Comey. Not on these facts. It would be fair — if that person 
worked for me, it would be fair to have a robust disciplinary pro- 
ceeding. It’s not fair to prosecute that person on these facts. 

Mr. Hurd. Mr. Chairman, I yield back the time I do not have. 

Chairman Chaffetz. Thank the gentleman. We’ll now recognize 
the gentleman from Pennsylvania, Mr. Cartwright, for 5 minutes. 

Mr. Cartwright. Thank you, Mr. Chairman. And I’d like to open 
by acknowledging my colleague from North Carolina, Mr. Meadows, 
here he comes back in the room, for acknowledging your integrity. 
Director Comey. I think bipartisan sentiments like that are few 
and far between around here. And I appreciate Congressman 
Meadows’ remark. You are a man of integrity. Director Comey. It’s 
troubling to me that that remark from Congressman Meadows is 
not unanimous at this point. It used to be. Just weeks ago, our 
chairman. Representative Chaffetz, stated on national TV that Re- 
publicans, quote, “Believe in James Comey,” unquote. He said this, 
and I quote, “I do think that in all of the government, he is a man 
of integrity and honesty. His finger’s on the pulse of this. Nothing 
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happens without him. And I think he is going to be the definitive 
person to make a determination or a recommendation.” 

But just hours after your actual recommendation came out, 
Chairman Chaffetz went on TV and accused you of making a, 
quote, “political calculation.” And then our Speaker of the House, 
weeks ago, referring to you. Director Comey, said, “I do believe that 
his integrity is unequalled. So you’re integrity — it was unanimous 
about your integrity before you came to your conclusion. But after, 
not so much. That’s troubling. And I want to give you a chance. Di- 
rector Comey, how do you respond to that? How important to you 
is maintaining your integrity before the Nation? 

Mr. Comey. I think the only two things I have in life that matter 
are the love of my family and friends and my integrity. So I care 
deeply about both. 

Mr. Cartwright. All right. Now, Director Comey, you discussed 
your team a little bit. And they deserve a lot of credit for all of the 
hard work and effort that went into this investigation. And I think 
you just said that they were unanimous. That everyone who looked 
at this agreed that no reasonable prosecutor would bring a case. 
Am I correct in that? 

Mr. Comey. Yes. 

Mr. Cartwright. How many people were on this team? 

Mr. Comey. It changed at various times, but somewhere between 
15 and 20, and then we used a lot of other FBI folks to help from 
time to time. 

Mr. Cartwright. And how many hours were spent on this inves- 
tigation? 

Mr. Comey. We haven’t counted yet. They — I said to them they 
moved — they put 3 years of work into 12 calendar months. 

Mr. Cartwright. And how many pages of documents did the FBI 
review in this investigation? 

Mr. Comey. Thousands and thousands and thousands. 

Mr. Cartwright. And the agents doing the document review, 
were they qualified or were they unqualified? 

Mr. Comey. They were an all-star team. They are a great group 
of folks. 

Mr. Cartwright. How about Secretary Clinton? Did she agree to 
be interviewed? 

Mr. Comey. Yes. 

Mr. Cartwright. Come in voluntarily without the need of a sub- 
poena? 

Mr. Comey. Yes. 

Mr. Cartwright. Was she interviewed? 

Mr. Comey. Yes. 

Mr. Cartwright. Was she interviewed by experienced critical 
veteran agents and law enforcement officers, or by some kind of 
credulous gullible newbies doing their on-the-job training. Director? 

Mr. Comey. She was interviewed by the kind of folks the Amer- 
ican people would want doing the interview. Real pros. 

Mr. Cartwright. All right. You were asked about markings on 
a few documents. I have the manual here. Marking Classified Na- 
tional Security Information. And I don’t think you were given a full 
chance to talk about those three documents with the little Cs on 
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them. Were they properly documented? Were they properly marked 
according to the manual? 

Mr. COMEY. No. 

Mr. Cartwright. According to the manual, and I ask unanimous 
consent to enter this into the record, Mr. Chairman. 

Chairman Chaffetz. Without objection, so ordered. 

Mr. Cartwright. According to the manual, if you’re going to 
classify something, there has to be a header on the document, 
right? 

Mr. Comfy. Correct. 

Mr. Cartwright. Was there header on the three documents that 
we’ve discussed today that had the little C in the text someplace? 

Mr. CoMEY. No. They were three emails. The C was in the body, 
in the text. But there was no header on the email or in the text. 

Mr. Cartwright. So if Secretary Clinton really were an expert 
at what’s classified and what’s not classified, and were following 
the manual, the absence of a header would tell her immediately 
that those three documents were not classified. Am I correct in 
that? 

Mr. CoMEY. That would be a reasonable inference. 

Mr. Cartwright. All right. I thank you for your testimony. Di- 
rector. I yield back. 

Chairman Chaffetz. I thank the gentleman. We’ll now recognize 
the gentleman from Colorado, Mr. Buck, for 5 minutes. 

Mr. Buck. Good morning. Director Comey. 

Mr. Comey. Good morning, sir. 

Mr. Buck. Thank you for being here. I also respect your commit- 
ment to law and justice and your career. And the first question I 
want to ask you is this hearing unfair? Has it been unfair to you? 

Mr. Comey. No. 

Mr. Buck. Thank you. One purpose of security procedures for 
classified information is to prevent hostile nations from obtaining 
classified information. Is that fair? 

Mr. Comey. Yes. 

Mr. Buck. And did hostile nations obtain classified information 
from Secretary Clinton’s servers? 

Mr. Comey. I don’t know. It’s possible. But we don’t have direct 
evidence of that. We couldn’t find direct evidence. 

Mr. Buck. I want to, without making this a law school class, I 
want to try to get into intent. There are various levels of intent in 
the criminal law. Everything from knowingly and willfully doing 
something all the way down to strict liability. Would you agree 
with me on that? 

Mr. Comey. Yes. 

Mr. Buck. And in Title 18, most of the criminal laws in Title 18 
have the words “knowingly” and “willfully” in them. And that is 
the standard typically that United States attorneys prosecute 
under. 

Mr. Comey. Most do. Unlawfully, knowingly, and willfully is our 
standard formulation for charging a case. 

Mr. Buck. And there are also a variety of others between the 
knowingly and willfully standard and the strict liability standard. 
And many, like environmental crimes, have a much lower standard 
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because of the toxic materials that are at risk of harming individ- 
uals. Is that fair? 

Mr. CoMEY. That’s correct. 

Mr. Buck. Okay. Let’s talk about this particular statute, 18 
U.S.C. 1924. I take it we could all agree — or you and I can agree 
on a couple of the elements. She, Secretary Clinton, was an em- 
ployee of the United States. 

Mr. CoMEY. Correct. 

Mr. Buck. And as the result of that employment, she received 
classified information. 

Mr. CoMEY. Correct. 

Mr. Buck. And there’s no doubt about those two elements. Now, 
I don’t know whether the next element is one element or two, but 
it talks about knowingly removes such materials without authority, 
and with the intent to retain such material at an unauthorized lo- 
cation. So I’m going to treat those as two separate parts of the in- 
tent element. 

First of all, do you see the word “willfully” anywhere in the stat- 
ute? 

Mr. COMEY. I don’t. 

Mr. Buck. Okay. And that would indicate to you that there is a 
lower threshold for intent? 

Mr. COMEY. No, it wouldn’t. 

Mr. Buck. Why? 

Mr. CoMEY. Because we often, as I understand the Justice De- 
partment’s practice and judicial practice, will impute to any crimi- 
nal statute at that level with a knowingly also requirement that 
you know that you’re involved in criminal activity of some sort. A 
general mens rea requirement. 

Mr. Buck. And you would apply that same standard to environ- 
mental crimes? 

Mr. CoMEY. No. If it specifically says it’s a negligence-based 
crime, I don’t think a judge would impute that. 

Mr. Buck. But Congress specifically omitted the word “willfully” 
from this statute. And yet you are implying the world “willfully” in 
the statue. Is that fair? 

Mr. CoMEY. That’s fair. 

Mr. Buck. Okay. So what the statute does say is knowingly re- 
moves such materials without authority. Is it fair that she knew 
that she didn’t have authority to have this server in her basement? 

Mr. CoMEY. Yes. That’s true. 

Mr. Buck. And she knew that she was receiving materials, clas- 
sified information, in the emails that she received on her Black- 
Berry and other devices? 

Mr. CoMEY. I can’t answer — I’m hesitating as a prosecutor be- 
cause it’s always — to what level of proof? I do not believe there’s 
evidence beyond a reasonable doubt that she knew she was receiv- 
ing classified information in violation of the requirements. 

Mr. Buck. But that’s not my question. My question, in fairness, 
is did she know that she was receiving information on the servers 
at her location? 

Mr. CoMEY. Oh, I’m sorry. Of course. Yes. She knew she was 
using her email system. 
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Mr. Buck. And as Secretary of State, she also knew that she 
would he receiving classified information. 

Mr. CoMEY. Yes. In general. 

Mr. Buck. Okay. And did she then have the intent to retain such 
material at an unauthorized location? She retained the material 
that she received as Secretary of State at her server in her base- 
ment and that was unauthorized? 

Mr. CoMEY. You’re asking me did she have the — and I’m going 
to ask you the burden of proof question in a second. But did she 
have the intent to retain classified information on the server, or 
just to retain any information on the server? 

Mr. Buck. Well, we’ve already established that she knew, as Sec- 
retary of State, that she was going to receive classified information 
in her emails. And so did she retain such information that she re- 
ceived as Secretary of State on her servers in her basement? 

Mr. COMEY. She did, in fact. There is, in my view, not evidence 
beyond certainly probable cause. There’s not evidence beyond a rea- 
sonable doubt that she knew she was receiving classified informa- 
tion, or that she intended to retain it on her server. There’s evi- 
dence of that. But when I said there’s not clear evidence of intent, 
that’s what I meant. I could not, even if the Department of Justice 
would bring that case, I could not prove beyond a reasonable doubt 
those two elements. 

Mr. Buck. Thank you very much. 

Chairman Chaffetz. Thank the gentleman. We’ll now go to the 
gentlewoman from Illinois, Ms. Duckworth, for 5 minutes. 

Ms. Duckworth. Thank you, Mr. Chairman. When I first en- 
tered Congress 3 years ago, like many freshman members, I, unlike 
many freshman members, I actually sought out this committee. I 
wanted to be on this committee because I wanted to tackle the 
challenges of good government, like working to eliminate improper 
payments or prevent wasteful programs, duplication. Before I 
joined Congress, I had the privilege of serving in the Army for 23 
years. And I, you know, and as I tackled those challenges and in 
the challenges of helping reduce veterans’ homelessness, I wit- 
nessed firsthand the real-world importance of improving and 
streamlining government operations. How even the best policies in 
the world will not work without proper implementation. 

And so when it comes to implementing true and lasting reforms 
that will make sure the electronic records and other records and 
the history of our great Nation are preserved for future genera- 
tions, I’ve done my best to approach this goal seriously. I’m focused 
on making sure that our Nation sustains a long-term commitment 
to modernizing our Federal records keeping system, from improv- 
ing the laws governing what needs to be collected, to ensuring our 
civil servants across government have the necessary tools to 
achieve what should be nonpartisan and a shared goal. 

With respect to examining the tough lessons learned from nu- 
merous recordkeeping incidents that our committee has dealt with, 
which transcend any one agency or any single administration, my 
mission is clear: Make sure that we here in Congress move beyond 
partisan politics and engage in the serious hard work of ensuring 
that the laws written in an era of pen and paper are overhauled 
to meet the digital challenges of the 21st century. 
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Director Comey, the Office of Management and Budget and the 
National Archives and Records Administration released a memo- 
randum known as the Managing Government Records Directive in 
2012. And this directive states, and I quote, “By December 31, 
2016, Federal agencies will manage both permanent and temporary 
email records in an accessible electronic format. Federal agencies 
must manage all email records in an electronic format. Email 
records must be retained in an appropriate electronic system that 
supports records management and litigation requirements which 
may include preservation-in-place models, including the capability 
to identify, retrieve, and retain the records as long as they are 
needed.” 

As a Director of a Bureau who deals with sensitive information 
on a daily basis, do you believe that this directive is necessary and 
attainable for agencies across the board within that 4-year time- 
frame from August 2012 to December 2016. 

Mr. Comey. I don’t know enough to say both. I can say it’s cer- 
tainly necessary. I don’t know whether it’s achievable. 

Ms. Duckworth. Okay. Are you familiar with the Capstone Ap- 
proach? That’s the Federal — it’s approach that says that Federal 
agencies should save all emails for select senior level employees, 
and that the emails of other employees would be archived for a 
temporary period set by the agency so that senior employees’ 
emails are kept forever and those by other lower level employees 
are actually archived for a short period, a shorter period. 

Mr. Comey. I’m aware generally. I know what applies to me and 
when I was Deputy Attorney General in the Bush Administration. 

Ms. Duckworth. Yes. In fact, I understand that the FBI is cur- 
rently actively using this approach, according to the agency’s senior 
agency official for records — Office for Records Management fiscal 
year 2015 annual report. My understanding is the Capstone Ap- 
proach is aimed at streamlining the recordkeeping process for 
emails and reducing the volume of records that an agency has to 
maintain. Nearly all agencies will be required to comprehensively 
modernize their approach to managing Federal records in the near 
future. As the head of a component agency. Director Comey, within 
the Department of Justice, which appears to be a leader in adopt- 
ing the innovative Capstone Approach across the agency, would you 
agree that with respect to instituting foundational reforms that will 
strengthen records preservation, the Capstone Approach used by 
DOJ should be accelerated and wrote out across the Federal Gov- 
ernment? 

Mr. Comey. I think we’re doing it in a pretty good way. I don’t 
know — I’m not an expert enough to say whether everybody should 
do it the way we do it, honestly. 

Ms. Duckworth. Are you satisfied with the way that you’re 
doing it? 

Mr. Comey. I am, but I don’t want to sound overconfident, be- 
cause I’m sure there’s a way we can do it better. But I think we’re 
doing it in a pretty good way. 

Ms. Duckworth. Do you have any one person within the FBI 
that continually reviews the — your records keeping? And also do 
they report directly to you? As well as is there periodic review of 
how you’re implementing this process? 
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Mr. CoMEY. Yes. We have an entire division devoted to records 
management. That assistant director reports up to the deputy di- 
rector, who reports to me. We have — it’s an enormous operation, as 
you might imagine, requiring constant training. And so that’s what 
I mean when I say I think we’re doing it in a pretty good way. And 
we have record-marking tools, we prompt with dialogue boxes re- 
quiring employees to make a decision what’s the nature of this 
record you’re creating now and where should it be stored. So I 
think we’re doing it in a pretty good way. That’s why I say that. 

Ms. Duckworth. Have you seen that in any of the other agen- 
cies that you have interacted with, or have you had a chance, an 
occasion to look at what some of the other agencies are doing with 
their sensitive and classified information? Are they following the 
same technique as you’re doing in the FBI? 

Mr. COMEY. I don’t know enough to say, I personally. 

Ms. Duckworth. Okay. 

I am out of time, but thank you. 

Mr. CoMEY. Okay 

Chairman Chaffetz. I thank the gentlewoman. 

We’ll now recognize the gentleman from Michigan, Mr. Walberg, 
for 5 minutes. 

Mr. Walberg. I thank the chairman. 

And thank you. Director Comey, for being here. 

Mr. Chairman, thank you for holding this hearing. 

And, Director Comey, for making it very clear that you believe 
we’ve done this respectfully, with good intention. And I wish some 
of my colleagues that had instructed us on our intent were here. 
They have a great ability to understand intent better than, I guess, 
the Director of the FBI. 

But it is an intent that’s important here, that we understand we 
are Oversight and Government Reform Committee. And if indeed 
the tools aren’t there to make sure that our country is secure and 
that officials at the highest levels in our land don’t have the under- 
standing on what it takes to keep our country secure, that we do 
the necessary government reform to put laws in place that will be 
effective and will meet the needs of distinguished agencies and im- 
portant agencies like the FBI. 

So thank you, Mr. Chairman, for doing this hearing. It’s our re- 
sponsibility to do oversight and reform as necessary. 

Going back. Director Comey, to paraphrase the Espionage Act, 
people in the Seventh District of Michigan understand it from this 
perspective and common sense, what it says, that whoever being 
entrusted with information related to national defense, through 
gross negligence permits the information to be removed from its 
proper place in violation of their trust, shall be fined or imprisoned 
under the statute. 

There doesn’t seem to be a double standard there. It doesn’t ex- 
press intent. You’ve explained your understanding of why intent is 
needed, and we may agree or disagree on that, but the general pub- 
lic looking at that statute says it’s pretty clear. 

The question I would ask. Director Comey, what’s your definition 
of extremely careless, if you could go through that? 

Mr. Comey. I intended it as a commonsense term. It’s kind of one 
those kind of you know it when you see it sort of things. Somebody 
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who is — should know hotter, someone who is demonstrating a lack 
of care that strikes me as — there’s ordinary accidents and then 
there’s just real sloppiness. So I think of that as kind of real sloppi- 
ness. 

Mr. Walberg. So you stated that you had found 110 emails on 
Secretary Clinton’s server that were classified at the time they 
were sent or received, yet Secretary Clinton has insisted for over 
a year publicly that she never sent or received any classified 
emails. 

The question I have from that, would it be difficult for any Cabi- 
net-level official, and specifically any Cabinet official, let alone one 
who is a former White House resident or U.S. senator, to determine 
if information is classified? 

Mr. CoMEY. Would it be difficult for them to 

Mr. Walberg. Would it be difficult? 

Mr. COMEY. That’s hard to answer in the abstract. We’re trying 
to find the context in which they’re hearing it or seeing it. Obvi- 
ously, if it’s marked, which is why we require markings, it’s easy. 
It’s just too hard to answer, because there are so many other situa- 
tions you might encounter it. 

Mr. Walberg. But with the training that we receive and cer- 
tainly a Secretary of State would receive or someone who lives in 
the White House, that goes a little above and beyond just the com- 
monsense individual out there trying to determine. Knowing that 
classified information will be brought and to remove to an unau- 
thorized site ought to cause a bit of pause there, shouldn’t it? 

Mr. COMEY. Yeah. And if you’re a government official, you should 
be attentive to it 

Mr. Walberg. Absolutely. 

Mr. CoMEY. — ^because you know that the matters you deal with 
could involve sensitive information. So sure. 

Mr. Walberg. So Secretary Clinton’s revised statement that she 
never knowingly sent or received any classified information is prob- 
ably also untrue? 

Mr. CoMEY. Yeah. I don’t want to comment on people’s public 
statements. We did not find evidence sufficient to establish that 
she knew she was sending classified information beyond a reason- 
able doubt to meet that — the intent standard. But like I said, I un- 
derstand why people are confused by the whole discussion, I get 
that. But you know what would be a double standard? If she were 
prosecuted for gross negligence. 

Mr. Walberg. But your statement on Tuesday said there is evi- 
dence to support a conclusion that any reasonable person in Sec- 
retary Clinton’s position should have known that an unclassified 
system was no place for that conversation. 

Mr. CoMEY. I stand by that. 

Mr. Walberg. And that’s very clear. 

Mr. CoMEY. That’s the definition of carelessness, of negligence. 

Mr. Walberg. Which happened 

Mr. COMEY. Oh, yeah. 

Mr. Walberg. — as a result of our Secretary of State’s — former 
Secretary of State’s decisions. 

Mr. CoMEY. Yes. 
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Mr. Walberg. Is it your statement, then, before this committee 
that Secretary Clinton should have known not to send classified 
material, and yet she did? 

Mr. COMEY. Well, certainly she should have known not to send 
classified information. As I said, that’s the definition of negligent. 
I think she was extremely careless, I think she was negligent. 
That, I could establish. What we can’t establish is that she acted 
with the necessary criminal intent. 

Mr. Walberg. Do you believe that since the Department of Jus- 
tice hasn’t used the statute Congress passed, it’s invalid? 

Mr. COMEY. No, I think they’re worried that it’s invalid, that it 
will be challenged on constitutional grounds, which is why they’ve 
used it extraordinarily sparingly in the decades. 

Mr. Walberg. Thank you. I yield back. 

Chairman Chaffetz. I thank the gentleman. 

We’ll now go to — we’ll now recognize Mr. Lieu of California for 
5 minutes. 

Mr. Lieu. Thank you, Mr. Chair. 

As I read some of my Republican colleagues’ press statements, 
and as I sit here today, I am reminded of that quote from “Mac- 
beth”: “full of sound and fury, signifying nothing.” 

I’ve heard some sound and fury today from members of the com- 
mittee, and the reason they largely signify nothing is because of 
two fundamental truths that are self-evident. The first of which, 
none of the members of this committee can be objective on this 
issue. I can’t be objective. I’ve endorsed Hillary Clinton for Presi- 
dent, as have the Democratic members of this committee. My Re- 
publican colleagues can’t be objective. They oppose Hillary Clinton 
for President. 

Which is why we have you. You are a nonpartisan, career public 
servant that has served our Nation with distinction and honor. And 
not only can you be objective, it is your job to be objective, to apply 
the law fairly and equally regardless of politics. 

I think it would be important for the American people to get a 
fuller appreciation of your public service. So let me ask you, before 
you were FBI Director, how many years did you serve as a Federal 
prosecutor? 

Mr. CoMEY. I think 15. 

Mr. Lieu. For a period of time, you were at Columbia Law School 
as a scholar and you specialized in national security law. Is that 
correct? 

Mr. CoMEY. Sometimes I fantasize I still am. 

Mr. Lieu. All right. Thank you. 

When you served in the Republican administration of President 
George W. Bush, you were then the second-highest ranking mem- 
ber of the Department of Justice. Is that right? 

Mr. CoMEY. Yes. President Bush appointed me to be U.S. Attor- 
ney in Manhattan and then the number two in the Department of 
Justice. 

Mr. Lieu. When you were confirmed for the FBI Director posi- 
tion, the vote was 93-1. Is that correct? 

Mr. CoMEY. That’s correct. 

Mr. Lieu. With that strong bipartisan support, it’s not surprising 
that Senator Grassley, a Republican, said during your confirma- 



43 


tion, and I quote: “Director Comey has a reputation for applying 
the law fairly and equally regardless of politics.” 

In this case, did you apply the law fairly and equally regardless 
of politics? 

Mr. Comey. Yes. 

Mr. Lieu. Did you get any political interfere reasons from the 
White House? 

Mr. Comey. None. 

Mr. Lieu. Did you get any political interference from the Hillary 
Clinton campaign? 

Mr. Comey. None. 

Mr. Lieu. One of the reasons you’re appointed to a fixed term of 
10 years, a very long term, is to help insulate you from politics. 
Isn’t that right? 

Mr. Comey. That’s correct. 

Mr. Lieu. The second fundamental truth today about this hear- 
ing is that none of the members of this committee have any idea 
what we’re talking about, because we have not reviewed the evi- 
dence personally in this case. 

When I served on Active Duty in the U.S. Air Force in the 1990s, 
one of my duties was a prosecutor. One of the first things I learned 
as a prosecutor is it is unprofessional and wrong to make allega- 
tions based on evidence that one has not reviewed. 

So let me ask you, has any member of this committee, to the best 
of your knowledge, reviewed the 30,000 emails at issue in this 
case? 

Mr. Comey. I don’t know. Not to my knowledge. 

Mr. Lieu. Has any member of this committee sat through the 
multiple witness interviews that the FBI conducted in this case? 

Mr. Comey. No. That I know. No. 

Mr. Lieu. Has any member of this committee received any spe- 
cial information about the files that you kept or other FBI agents 
kept on this case? 

Mr. Comey. Not to my knowledge. 

Mr. Lieu. Now let’s do a little bit of math here. One percent of 
30,000 emails would be 300 emails. Is that right? 

Mr. Comey. I think that’s right. 

Mr. Lieu. Thirty emails would be one-tenth of 1 percent, and 
three emails would be 1 one hundredth of 1 percent of 30,000, 
right? 

Mr. Comey. I think that’s right. 

Mr. Lieu. Okay. So of those three emails, 1 one hundredth of 1 
percent of 30,000, they bore these tiny little classified markings, 
which is, as you described, a C with parentheses, correct? 

Mr. Comey. Correct. 

Mr. Lieu. It is certainly possible that a busy person who has sent 
and received over 30,000 emails just might miss this marking of a 
C with parentheses. It is possible, correct? 

Mr. Comey. Correct. 

Mr. Lieu. Okay. So let me now just conclude by stating what 
some of my colleagues have, which is, there is just the strongest 
whiff of hypocrisy going on here. The American public might be in- 
terested in knowing that all Members of Congress receive security 
clearances just for being a Member of Congress. We get to have pri- 
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vate email servers, we get to have private email accounts, we can 
use multiple devices, we can take devices overseas. 

And really at the end of the day, when the American people look 
at this hearing, they need to ask themselves this question: Do they 
trust the biased, partisan politicians on this committee who are 
making statements based on evidence we have not reviewed, or do 
they trust the distinguished FBI Director? I would trust the FBI 
Director. 

I yield back. 

Chairman Chaffetz. Thank you. 

We’ll now recognize the gentleman from Florida, Mr. Mica, for 5 
minutes. 

Mr. Mica. Thank you, Mr. Chairman. 

Director, how long did you investigate this matter? 

Mr. CoMEY. Just about a year. 

Mr. Mica. A year. And do you believe you conducted a legitimate 
investigation? 

Mr. CoMEY. Yes, sir. 

Mr. Mica. And it was a legitimate subject that was something 
that you should look into, you had that responsibility. Is that cor- 
rect? 

Mr. CoMEY. Yes. 

Mr. Mica. We have a responsibility to hear from you on the ac- 
tion that you took. This weekend — well, tomorrow we’ll go back to 
our districts, and we have to explain people. I’ll be at a couple of 
cafes where I see folks, in meetings, and they’re going to ask a lot 
of questions about what took place. 

Have you seen the Broadway production “Hamilton”? 

Mr. COMEY. Not yet. I’m hoping to. 

Mr. Mica. I haven’t either, but I understand it won the choreog- 
raphy Tony Award. I think you and others know that. 

The problem I have in explaining to my constituents is what’s 
come down, it almost looks like choreography. Let me just go over 
it real quickly with you. 

Last Tuesday, not this week, 1 week ago, former President Clin- 
ton meets with the Attorney General in Phoenix. The next Friday, 
last Friday, Mrs. Lynch, the AG, says she is going to defer to the 
FBI on whatever you came up with. On Saturday morning, I saw 
the vans pull up, this is this past Saturday, and you questioned 
Secretary Clinton for 3 hours. Is that — I guess that’s correct? 

Mr. CoMEY. Yeah. Three and a half. 

Mr. Mica. Okay. And then on Tuesday morning, the morning 
after July Fourth, we watched in our office, I had my interns, I 
said, “Come in, we’ve got the FBI Director, let’s hear what he has 
to say,” we’re all kind of startled, and you basically said you were 
going to recommend not to prosecute, correct? 

Mr. COMEY. Uh-huh. Yes, sir. 

Mr. Mica. And then Tuesday, well, we had President Obama and 
Secretary Clinton arrive in Charlotte at 2 o’clock, and shortly 
thereafter we had the Attorney General is closing the case. 

This is rapid fire. I mean, now, my folks think that there’s some- 
thing fishy about this. I’m not a conspiracy theorist, but there are 
a lot of questions on how this came down. I have questions about 
how this came down. 
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Did you personally interview the Secretary on Saturday morn- 
ing? 

Mr. COMEY. I didn’t personally, no. 

Mr. Mica. And how many agents did? 

Mr. COMEY. I think we had five or six in the room. 

Mr. Mica. Did you talk to all of those agents after the interview? 

Mr. CoMEY. I did not speak to all of them, no. 

Mr. Mica. Did she testify or talk to them under oath? 

Mr. CoMEY. No. 

Mr. Mica. She did not. Well, that’s a problem. But 

Mr. CoMEY. It’s still a crime to lie to us. 

Mr. Mica. I know it is. Do you have a transcript of that — 
that 

Mr. CoMEY. No. We don’t record our 

Mr. Mica. Do you have a 302, I guess it’s called, analysis? 

Mr. CoMEY. I do. I don’t have it with me, but I do. 

Mr. Mica. Did you read it? 

Mr. CoMEY. Yes. 

Mr. Mica. You did. Can we get a copy of it since the case is 
closed? 

Mr. CoMEY. I don’t know the answer to that. 

Mr. Mica. I would like a copy of it provided to the committee. 

I would like also for the last 30 days, any communications be- 
tween you or any agent or any person in the FBI with the Attorney 
General or those in authority in the Department of Justice on this 
matter. Could you provide us with that? 

Mr. CoMEY. We’ll provide you with whatever we can under the 
law and under our policy. It would actually be easy in my case. 

Mr. Mica. You see, the problem that I have, though, is I have 
to go back and report to people what took place. 

Mr. CoMEY. Sure. 

Mr. Mica. Now, did you write the statement that you gave on 
Tuesday? 

Mr. CoMEY. Yes. 

Mr. Mica. You did. And did you write — and you said you didn’t 
talk to all of the agents. But all of the agents, did they meet with 
you? And then is that the group that said that we all vote to not 
recommend prosecution? 

Mr. CoMEY. Well, yeah, I did not meet with all of the agents. I’ve 
met with — I guess I’ve met — I’ve with all of them at various times. 

Mr. Mica. But we’re getting the word that it was, like, unani- 
mous out of every — out of FBI that we don’t prosecute. 

Mr. COMEY. What’s your question. Congressman? 

Mr. Mica. Well, again, I want to know who counseled you. You 
read their summary, okay. She was not under oath. And it ap- 
pears — I mean, members have cited here where she lied or misled 
to Congress, which will lead now to the next step of our possibly 
giving you a referral on this matter. You’re aware of that? 

Mr. CoMEY. Yes. Someone mentioned that earlier. 

Mr. Mica. And that probably will happen. 

Thank you for shedding some light on what took place. 

Mr. CoMEY. Can I, Mr. Chairman 

Chairman Chaffetz. Sure. Go ahead. 

Mr. COMEY. — can I respond just very briefly? 
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I hope what you’ll tell the folks in the cafe is: Look me in the 
eye and listen to what I’m about to say. I did not coordinate that 
with anyone. The White House, the Department of Justice, nobody 
outside the FBI family had any idea what I was about to say. I say 
that under oath. I stand by that. There was no coordination. There 
was an insinuation in what you were saying that I don’t mean to 
get strong in responding, but I want to make sure I was definitive 
about that. 

Thank you, sir. 

Chairman Chaffetz. Thank you. 

We’ll now recognize the gentlewoman from the Virgin Islands, 
Ms. Plaskett, for 5 minutes. 

Ms. Plaskett. Thank you, Mr. Chairman. 

And thank you all for being here. 

Director Comey, I would rather be here talking with you about 
the FBI’s investigations and their resources to those individuals 
who are acting under color of law who have apparently committed 
egregious violations in the killings that we’ve seen in the recent 
days. 

But instead, Mr. Chairman, I’m sitting here and I’ve listened pa- 
tiently as a number of individuals have gone on national TV and 
made accusations against Director Comey, both directly and indi- 
rectly, because he recommended against prosecution based upon 
facts. 

I’ve listened just very recently here in this hearing as my es- 
teemed colleague from Florida tries to insinuate the condensation 
of an investigation into 1 week that actually occurred over a much, 
much longer period of time, and using that condensation and con- 
spiracy theory to say that there’s some orchestration. And that they 
have accused Mr. Director Comey of basing his decision on political 
considerations rather than facts. I’ve heard chuckles and laughter 
here in this hearing, and I don’t think there’s anything to be smil- 
ing or laughing about. 

Because I want to say something to those individuals who are 
chuckling and laughing and making attacks on Director Comey for 
doing his job: You have no idea who you’re talking about. Your ac- 
cusations are completely off base, utterly offensive to us as Amer- 
ican people. 

I know this because I’ve had the honor of working for Director 
Comey during my own service at the Department of Justice. From 
2002 to 2004, I served as senior counsel to the deputy attorney gen- 
eral. I worked with both the deputy attorney general, Larry 
Thompson, and Deputy Attorney General Jim Comey when he be- 
came deputy as a staff attorney. And I know from my own experi- 
ences that Director Comey is a man of impeccable integrity. 

There are very few times when you as an attorney or as an indi- 
vidual can work with individuals or a gentleman who is completely 
that, someone who is above the fray. Anyone who suggests or im- 
plies that he made his recommendations on anything but the facts 
simply does not know James Comey. 

We’ve used the term “no reasonable prosecutor.” Well, I know 
that James Comey doesn’t act as what a reasonable prosecutor 
would do, because he is the unyielding prosecutor, he is the pros- 



47 


ecutor who does what is politically not expedient for himself, his 
staff, but for the law. 

And I’m not the only person in this hearing, in this committee, 
who has worked with Director Comey or for him. Representative 
Gowdy himself also commended Director Comey, and he said this, 
and I quote: “I used to work with him. I think Comey is doing ex- 
actly what you want. He’s doing a serious investigation behind 
closed doors, away from the media’s attention, and I’m going to 
trust him until I see a reason not to.” 

Representative Gowdy referred to Director Comey as honorable 
and apolitical. He said this is exactly what you want in law en- 
forcement. Well, it’s exactly what you want in law enforcement 
until the decision is not the decision that you want. 

Director Comey, Chairman Chaffetz, as it was said by one of my 
colleagues, went on television and accused you of making, quote, “a 
political calculation.” He said that your recommendation was noth- 
ing more than, quote, “a political determination in the end.” 

I’m going to ask you, how do you respond to that? Were your ac- 
tions in any way, shape, or form governed by political consider- 
ation? 

Mr. Comey. No, not in any way. 

Ms. Plaskett. And did anyone with Secretary Clinton’s cam- 
paign or the administration influence your recommendation for po- 
litical reasons? 

Mr. Comey. No. They didn’t influence it in any way. 

Ms. Plaskett. I’m going to take you at your word, because I 
know, and those who will go through the record of your long tenure 
as a career prosecutor and they’ll look at examples, will see that 
you have taken decisions that have not been that which your su- 
pervisors, which the President, which others have wanted you to 
take. 

As a Federal prosecutor who believed that the facts must come 
above politics. I’m thankful that we have you. And, Director 
Comey, I want to thank you for your service to our country, and 
you have our support. 

We would like to see as much documents. And I’m grateful that 
you want to keep the transparency so that the American public can 
understand the difference between what they hear in the media 
and the elements of a crime necessary for criminal prosecution. 

Thank you. 

Chairman Chaffetz. I thank the gentlewoman. 

We’ll now recognize the gentleman from Texas, Mr. Farenthold, 
for 5 minutes. 

Mr. Farenthold. Thank you very much. Director Comey. 

I want to talk a little bit about cybersecurity. The State Depart- 
ment’s inspector general report detailed instances of multiple at- 
tacks on Secretary Clinton’s computer as well as her replying to 
suspicious email from the personal account of the Undersecretary 
of State. 

Director, you said that hostile actors successfully gained access 
to the commercial email accounts of people Secretary Clinton regu- 
larly communicated with. In the case of the Romanian hacker, 
Guccifer, accessing Sidney Blumenthal’s account. And, you know, 
that’s been public for some time. 
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During your investigation, were there other people in the State 
Department or that regularly communicated with Secretary Clin- 
ton that you can confirm were successfully hacked? 

Mr. CoMEY. Yes. 

Mr. Farenthold. And were these folks that regularly commu- 
nicated with the Secretary? 

Mr. CoMEY. Yes. 

Mr. Farenthold. And were you able to conclude definitively that 
the attempted hacks referenced in the IG report were not success- 
ful? 

Mr. CoMEY. We were not able to conclude that they were success- 
ful. I think that’s the best way to say it. 

Mr. Farenthold. All right. So while you said that given the na- 
ture of Clinton’s server, you would be unlikely to see evidence one 
way or the other of whether or not it had been successfully hacked, 
how many unsuccessful attempts did you uncover? Did you find 
any there? 

Mr. CoMEY. There were unsuccessful attempts. I don’t know the 
number off the top of my head. 

Mr. Farenthold. Do you have an idea, were they from foreign 
governments? Where did they come from? 

Mr. CoMEY. I want to be careful what I say in an open setting, 
and so I — we can give you that information, but I don’t want to 
give any foreign governments knowledge of what I know. So 
there 

Mr. Farenthold. All right. But would you be so far as to say 
they probably weren’t American high school students fooling 
around? 

Mr. CoMEY. Correct. It was not limited to 

Mr. Farenthold. All right. 

Mr. COMEY. — criminal activity. 

Mr. Farenthold. During your investigation, did you or anyone 
in the FBI interview the hacker Guccifer? 

Mr. CoMEY. Yes. 

Mr. Farenthold. And he claimed he gained access to Sid 
Blumenthal’s email account and traced him back to Clinton’s pri- 
vate server. Can you confirm that Guccifer never gained access to 
her server? 

Mr. CoMEY. Yeah, he did not. He admitted that was a lie. 

Mr. Farenthold. All right. Well, at least that’s good to hear. 

All right. Section 793 of Title 18 of the United States Code 
makes it a crime to allow classified information to be stolen 
through gross negligence. Were you to discover that hostile actors 
had actually gotten into Secretary Clinton’s email, would that have 
changed your recommendation with respect to prosecuting her? 

Mr. COMEY. Unlikely, although we didn’t consider that question, 
because we didn’t have those facts. 

Mr. Farenthold. All right. I want to go back to the question of 
intent real quick for just a second. I’m a recovering attorney, it’s 
been decades since I actually practiced law, but you kept referring 
to she had to know it was illegal to have the requisite criminal in- 
tent. I was always taught in law school, and I don’t know where 
this changed, that ignorance of the law was no excuse. If I’m driv- 
ing along at 45 miles an hour and didn’t see the 35-mile-an-hour 
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speed limit, I was still intentionally speeding even though I didn’t 
know it. 

Now, I might not have had the requisite criminal intent if mayhe 
my accelerator were jammed or something like that, but even 
though I didn’t know the law was 35, I was driving 45, I’m going 
to get a ticket and I’m probably going to be prosecuted for that. 

So how can you say ignorance of the law is an excuse in Mrs. 
Clinton’s case? 

Mr. COMEY. Well, the comparison to petty offenses, I don’t think 
is useful. But the question of ignorance of the law is no excuse. But 
here’s the distinction. You have to have general criminal intent. 
You don’t need to know what particular statute you’re violating, 
but you must be aware of the generally wrongful nature of your 
conduct. That’s what 

Mr. Farenthold. Now, so Congress, when they enacted that 
statute, said gross negligence. 

Mr. CoMEY. Yep. 

Mr. Farenthold. That doesn’t say intent. So what are we going 
to have to enact to get you guys to prosecute something based on 
negligence or gross negligence? So are we going to have to add, 
“And, oh, by the way, we don’t mean you — we really do mean you 
don’t have to have intent there”? 

Mr. COMEY. Well, that’s a conversation for you all to have with 
the Department of Justice, but it would have to be something more 
than the statute enacted in 1917, because for 99 years they’ve been 
very worried about its constitutionality. 

Mr. Farenthold. All right. Well, I think that’s something this 
committee and Congress as a whole, the Judiciary Committee that 
Mr. Chaffetz and I also sit on, will be looking at it. 

And I was on television this morning, and I just want to relay 
a question that I received from a caller into that television commer- 
cial, and it’s just real simple. Why should any person follow the law 
if our leaders don’t? 

And we can argue about intent or not, but you laid out the fact 
that she basically broke the law but you couldn’t prove intent. 
Maybe I’m putting words in your mouth, but I do want to know 
why any person should follow the law if our leaders don’t have to. 
Maybe that’s rhetorical, but I’ll give you an opportunity to com- 
ment on that. 

Mr. CoMEY. Yeah. That’s a question I’m no more qualified to an- 
swer than any American citizen. It’s an important question. 

In terms of my work in my world, my folks would not be — one 
of my employees would not be prosecuted for this. They would face 
consequences for this. So the notion that it’s either prosecute or 
you walk around, you know, smiling all day long is just not true 
for those people who work for the government. The broader ques- 
tion is one for a democracy to answer, it’s not for me. 

Mr. Farenthold. And I guess the ultimate decision as to wheth- 
er or not Mrs. Clinton works in government or not is not in — is in 
everybody’s hands. 

Chairman Chaefetz. I thank the gentleman. 

Mr. Farenthold. Yield back. 

Chairman Chaffetz. We’ll now recognize the gentleman from 
Pennsylvania, Mr. Boyle, for 5 minutes. 
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Mr. Boyle. Thank you, Mr. Chairman. 

And thank you, Director Comey, for appearing, especially on such 
short notice. 

I want to share with you actually something a friend of mine was 
expressing when watching your press conference 48 hours ago, and 
this is someone who’s not in any way political; in fact, probably 
typical of most American citizens today in being depressed about 
the remarkable level of cynicism we have in our government, but 
specifically those of us who are in government make decisions first 
and foremost because of the party hat we wear and not necessarily 
based on the facts and the evidence. 

And he texted me after watching your 15-minute presentation: 
Oh, it’s nice to see a real pro. You can tell that he would make the 
decision based on the facts and the evidence and not what party 
he wears. 

I think that’s so important if we’re ever going to get to a place 
in this country where we restore some of the faith that we had in 
government. If you looked at the poll numbers from the 1940s and 
1950s and you look at faith in government among the American 
public, and you look at those numbers today, the numbers today 
are anemic, they’re nowhere near the levels that they were decades 
ago. 

So for that, I want to say thank you. And I think that many citi- 
zens have the same impression. 

When I first met you a couple years ago at a weekend session 
in Colonial Williamsburg, you might remember that we had a dis- 
cussion about my biggest concern, frankly, facing the security of 
the American people, and that is the possibility of a lone wolf ter- 
rorist, someone becoming self-radicalized and acting based on that. 
We had an exchange that I’ll keep private, but I think I can charac- 
terize that you share my concern. 

I’m just thinking, for the last 2-1/2 hours that we’ve been here, 
we’ve had the FBI Director, asking questions on this matter, when, 
frankly, I would have much rather your time spent dealing with 
the potential of lone wolf terrorists and other coordinated attacks 
that we face. 

But since this is the Oversight and Government Reform Com- 
mittee, trying to find something that we can now take and possibly 
use in a systemic way, not just the celebrity of Secretary Clinton 
and the fact, because it involves her, let’s face it, that’s the reason 
why we’re here, but I want to try to take something out of this very 
expensive and long investigation and try to use it in a productive 
way toward reforming government that possibly we can get some- 
thing good out of it. 

So toward that end. I’m really concerned about this issue of up- 
classification, because it seems as if, and I was not aware of this 
until the investigation, there is quite a strong discrepancy between 
not just former Secretary Clinton, but even former Secretary Pow- 
ell, what he thinks should be classified, and then what is classified 
after the fact. And I think you — if I’m right, there were some 2,000 
emails that were up-classified? I was wondering if you could speak 
to that. 

Mr. Comey. Yeah. It actually was not a concept I was real famil- 
iar with before this. It’s the notion that something might not have 
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been classified at the time, but that in hindsight, as a government 
agency considers releasing it, they raise the classification level to 
protect it because it would — it’s a candid assessment of a foreign 
leader or something like that. 

I think it is largely a State Department thing, because their dip- 
lomats will often be conversing in an unclassified way, that when 
they look at releasing it in response to a FOIA request, they think 
it ought to be protected in some fashion. 

But, honestly, I kind of pushed those to the side. 

Mr. Boyle. Right. 

Mr. CoMEY. The important thing here was what was classified at 
the time, that’s what matters. 

Mr. Boyle. Right. And that for a law enforcement official mat- 
ters. But I’m just wondering if you could share with us any of your 
impressions about a system that exists where there is such gray 
area and discrepancy in what is classified and what’s not, and if 
you or your agents had any suggestions for us, either in Govern- 
ment Reform, or I happen to be on the Foreign Affairs Committee 
that has oversight of State Department. 

Do you believe that this is a matter that we should take up 
where there is such discrepancy on what’s classified, what’s not 
classified? I think of one example. Ambassador Ross put something 
in a book that wasn’t classified, and then it was up-classified after 
the book came out. But what good does that do us as a country in 
terms of trying to protect the intelligence of the United States. 

Mr. COMEY. Yeah. I’m not an expert in this up-classification busi- 
ness, but I do suspect it would be a fertile ground for trying to fig- 
ure out whether there are ways to do it in a more predictable, reli- 
able way. 

Mr. Boyle. Yeah. Well, thank you again for your service. 

And I yield back my time. 

Chairman Chaffetz. I thank the gentleman. 

We’ll now recognize the gentleman from Georgia, Mr. Hice, for 5 
minutes. 

Mr. Hice. Director Comey, your statement on Tuesday clearly 
showed that Secretary Clinton not only was extremely careless in 
handling classified information, but that also any reasonable per- 
son should have known better, and that also, in doing so, she put 
our national security at risk with her reckless behavior. 

So it seems to me that the American people are only left, based 
on your assessment, with just a few options. Either Secretary Clin- 
ton herself is not a reasonable person, or she is someone who pur- 
posefully, willfully exhibited disregard for the law, or she is some- 
one who sees herself as above the law. 

And to muddy the water even further, after listening to you lay 
out the facts of the investigation, much of what you said directly 
contradicted her in previous statements that she had made. 

I think it’s all this compiled, putting the — connecting the dots 
that so many American people are irate, that after all of this there 
was not a recommendation for Secretary Clinton to be prosecuted. 

Now, I do greatly appreciate the fact that you came out with 
much more information on this than you would have in other cases, 
and I think that was the right the thing to do. Undeniably, this is 
not a typical case. This is something of great public interest, obvi- 
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ously the subject of the investigation, former Secretary of State, 
former senator, and all those things that we have talked about, 
former first lady, and so forth. 

And in addition to this, her husband, who happens to be the 
former President of the United States, is meeting privately with 
the Attorney General right before all of this interview takes place. 
Obviously, this is very suspicious, just the optics of it all. And at 
the same time that you’re coming out, or more or less the same 
time that you are announcing the decision. Secretary Clinton is fly- 
ing around in Air Force One with the President doing a campaign 
event. 

I mean, there’s nothing about this case that’s ordinary, there’s 
nothing about the subject that’s ordinaiy. 

So let me ask you this. Director: Did Secretary Clinton in fact, 
comply with the Department’s policies or the Federal Records Act? 

Mr. COMEY. I don’t think so. I know you have the State inspector 
general here, who’s more of an expert on all the Department’s poli- 
cies, but at least in some respects, no. 

Mr. Hice. So keeping the servers at home and all these types of 
things, obviously, is not in compliance with the Department’s poli- 
cies? 

Mr. CoMEY. Yes. And I’ve read the inspector general’s report on 
that. That’s part of the reason I can answer that part with some 
confidence. 

Mr. Hice. Okay. And yet she said publicly that she fully com- 
plied. So there again is another issue. 

If you had the same set of facts but a different subject, a dif- 
ferent individual involved, say, just an average, ordinary State De- 
partment employee or an anonymous contractor, what would have 
been the outcome? 

Mr. COMEY. I’m highly confident there would be no criminal pros- 
ecution no matter who it was. There would be some range of dis- 
cipline. They might get fired, they might lose their clearance, they 
might get suspended for 30 days. There would be some discipline, 
maybe just a reprimand, I doubt it, I think it would be higher on 
the discipline spectrum, but some sort of discipline. 

Mr. Hice. So is it your opinion that there should likewise be 
some discipline in this case? 

Mr. CoMEY. That’s not for me to say. I can talk about what 
would happen if it was a government employee under my responsi- 
bility. 

Mr. Hice. Well, then, what you’re laying out is that there is a 
double standard. For someone else, a different subject, an anony- 
mous contractor or someone at the State Department, there would 
absolutely be discipline, but because of who the subject is, you’re 
not willing to say there should be discipline. So there’s — again, this 
whole issue, this is what the American people are so upset about. 

Let me say that, when you stated that no reasonable prosecutor 
would pursue this case, is that because the subject of this inves- 
tigation was unique? 

Mr. CoMEY. No. Huh-uh. There’s no double standard there. And 
there’s no double standard, either, in the sense that if it was John 
Doe, a former government employee, you’d be in the same boat. We 
wouldn’t have any reach on the guy. He wouldn’t be prosecuted. 
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Mr. Hice. But he would have some discipline? 

Mr. CoMEY. Well, not if he had left government service. 

Mr. Hice. Had they lied about having servers, had they lied 
about sending and receiving classified emails, had they lied about 
not deleting those emails to the public, had they lied about not 
having any marked classified, the statements are clearly docu- 
mented, and you’re saying that an average person would experience 
discipline, by your own words, but Secretary Clinton does not de- 
serve to be disciplined? 

Mr. Gowdy. [Presiding.] The gentleman’s time has expired, but 
the Director may answer if he wants to. 

Mr. CoMEY. An average employee still in government service 
would be subject to a disciplinary process. Now, if they’d left, you’d 
be in the same boat. 

Mr. Gowdy. The gentleman from Georgia yields back. 

The chair will now recognize the gentleman from Vermont, Mr. 
Welch. 

Mr. Welch. Thank you very much, Mr. Chairman. 

Thank you. Director Comey. 

The prosecutor has really awesome power. The power to pros- 
ecute is the power to destroy and it has to be used with restraint. 
You obviously know that. You’re being asked to — you had to exer- 
cise that responsibility in the context of a very contested Presi- 
dential campaign, enormous political pressure. 

You had to do it once before. And I go back to that evening of 
March 10, 2004, when the question was whether a surveillance pro- 
gram authorized after 9/11 by President Bush was going to con- 
tinue despite the fact that the Justice Department had come to an 
independent legal conclusion that it actually violated our constitu- 
tional rights. 

That’s a tough call, because America was insecure, the President 
was asserting his authority as Commander in Chief to take an ac- 
tion that was intended to protect the American people, but you and 
others in the Justice Department felt that, whatever that justifica- 
tion was, the Constitution came first and you were going to defend 
it. 

And as I understand it, you were on your way home and had to 
divert your drivers to go back to the hospital to be at the bedside 
of a very sick at that time Attorney General, and you had to stand 
in the way of the White House chief of staff and the White House 
counsel. 

I’m not sure that was a popular decision or one that you could 
have confidently thought would be a career booster, but I want to 
thank you for that. 

Fast forward, we’ve got this situation of a highly contested polit- 
ical campaign. And there is substantive concern it’s legitimate by 
Democrats and Republicans for independent political reasons, but 
you had to make a call that was based upon your view of the law, 
not your view of how it would affect the outcome of who would be 
the next Commander in Chief. 

Others have asked this for you, but I think I’m close to the end. 
I want to give you a chance to just answer, I think, the bottom line 
questions here. Had you, after your thorough investigation, found 
evidence that suggested that criminal conduct occurred, is there 
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anything, anything or anyone, that could have held you back from 
deciding to prosecute? 

Mr. CoMEY. No. I mean, I don’t have the power to decide pros- 
ecution, but I’d have worked very hard to make sure that a right- 
eous case was prosecuted. 

Mr. Welch. And you would have make that recommendation to 
the Attorney General? 

Mr. CoMEY. Yes. 

Mr. Welch. Was there any interference, implicit or explicit, from 
the President of the United States or anyone acting on his behalf 
to influence the outcome of your investigation and the rec- 
ommendation that you made? 

Mr. CoMEY. No. 

Mr. Welch. Was there anyone in the Hillary Clinton campaign 
or Hillary Clinton herself who did anything, directly or indirectly, 
to attempt to influence the conclusion that you made to recommend 
no prosecution? 

Mr. CoMEY. No. 

Mr. Welch. At this moment, after having been through several 
hours of questioning, is there anything in the questions you’ve 
heard that would cause you to change the decision that you made? 

Mr. COMEY. No. I don’t — you know, I don’t love this, but it’s real- 
ly important to do, and I understand the questions and concerns. 
I just want the American people to know, we really did this the 
right way. You can disagree with us, but you cannot fairly say we 
did it in any kind of political way. We don’t carry water for any- 
body. We’re trying to do what the right thing is. 

Mr. Welch. Well, I very much appreciate that, and I very much 
appreciate that it takes strong people of independent judgment to 
make certain that we continue to be a Nation of laws. 

Mr. Chairman, just one final thing, and I’ll yield to Mr. Cum- 
mings. We’ve got a political debate where a lot of these issues that 
are going to be — that have been raised are going to be fought in 
the campaign, and we’ve got Secretary Clinton who’s going to have 
to defend what she did. She’s acknowledged it’s a mistake. We’ve 
got that great constitutional scholar, Mr. Trump, who’s going to be 
making his case about why this was wrong. But that’s politics, 
that’s not really having anything to do with the independence of 
prosecutorial discretion. 

Thank you. Director Comey. 

And I yield whatever additional time I have to Mr. Cummings. 

Chairman Chaffetz. I think the gentleman’s going to yield back. 
I’ve spoken with Mr. Cummings. 

We’ll now recognize the gentleman from Kentucky, Mr. Massie, 
for 5 minutes. 

Mr. Massie. Thank you, Mr. Chairman. 

And thank you. Director Comey, for showing up and your willing- 
ness to be transparent and answer a lot of unanswered questions. 

A few hours before this hearing started I went onto social media 
and asked people to submit questions, and I’ve got over 500 ques- 
tions, and I don’t think I’ll get to ask them all in these 5 minutes, 
but I’m sure you’ll be willing to answer them. 

One of the common things that I came in here to ask, but I real- 
ized it’s not the right question now, is what’s the difference be- 



55 


tween extremely careless and gross negligence. But in the process 
of this hearing, what I’m hearing you say is, that’s not what we — 
that’s not what your reluctance is based on, it’s not based on — the 
reluctance to prosecute, by the way. Your reluctance to recommend 
a prosecution or an indictment is not based on parsing those words, 
it’s based on your concern for this statute, with this statute, is that 
correct, from your opening statement? 

Mr. CoMEY. It’s broader than that, actually, the statute, and it 
fits within a framework of fairness and also my understanding of 
what the Department of Justice has prosecuted over the last 50 
years. 

Mr. Massie. So when you say a reasonable prosecutor wouldn’t 
take this case, it’s not because you don’t think she made — that she 
lied in public or that maybe she was negligent, it’s because you 
have concern with the prosecutorial history of the statute? 

Mr. CoMEY. And not just that statute, but also 1924, which is the 
misdemeanor. I also don’t see cases that were prosecuted on facts 
like these. So both, both 793 and 1924. 

Mr. Massie. But you did find one prosecution. And has it been 
overturned by the Supreme Court? 

Mr. CoMEY. No. There was one time it was charged in an espio- 
nage case, and the guy ended up pleading guilty to a different of- 
fense, so it was never adjudicated. 

Mr. Massie. So, you know, so that your concern is with the neg- 
ligence threshold, that you think it requires mens rea, or knowing 
the crime. But in all 50 States isn’t there a negligent homicide stat- 
ute and aren’t people prosecuted for that all the time, and doesn’t 
the Supreme Court and all the courts below that uphold those pros- 
ecutions, just on the basis of negligence? 

Mr. CoMEY. I don’t know whether all 50 States. I think negligent 
homicide and manslaughter statutes are relatively common. 

Mr. Massie. Okay. So but don’t all 50 States have something like 
that, and aren’t those sustained in the upper courts, those convic- 
tions? 

Mr. CoMEY. I don’t know whether all 50 States have something 
like that. But, again, I think it’s very common and I think those 
are sustained. 

Mr. Massie. So don’t we have a history of — you know, you im- 
plied that the American judicial system doesn’t have a history of 
convicting somebody for negligence, but don’t we in other domains 
of justice? 

Mr. CoMEY. We do. I know the Federal system best. There are 
very few in the Federal system. They’re mostly, as we talked about 
earlier, in the environmental and Food and Drug Administration 
area. 

Mr. Massie. Okay. Thank you. 

Now, I want to ask another question that’s come up here. You’ve 
basically related to us that this information, this top secret or clas- 
sified information, got into these email chains because of conversa- 
tions people were having, they were relating what they heard be- 
fore in other settings. Is that correct? 

Mr. CoMEY. No. Maybe in some cases, but it was people having 
an email conversation about a classified subject. 
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Mr. Massie. Okay. So they were having an email conversation, 
hut how in this email conversation did this hore marking show up? 
Like, if they’re not sophisticated enough, as you said before, even 
Hillary Clinton wasn’t sophisticated enough to recognize a hore 
marking, the C with the parentheses for confidential or classified, 
how did — if they weren’t that sophisticated, how did they recreate 
that hore marking in their emails when they were having these 
discussions? 

Mr. CoMEY. Yeah. Somebody — a lot of what ended up on Sec- 
retary Clinton’s server were stuff that had been forwarded up a 
chain and gets to her from her staff, a lot of that forwarding, and 
then she comments sometimes on it. 

Someone down in the chain, in typing a paragraph that summa- 
rized something, put a portion marking, C — paren, C paren, on 
that paragraph. 

Mr. Massie. Can you — doesn’t it take a lot of intent to take a 
classified document from a setting that’s, you know, authorized and 
secure to one that’s not? Wouldn’t it require intent for somebody 
to recreate that classification marking in an unsecure setting? 

Mr. CoMEY. I don’t know. It’s possible, but also I could 

Mr. Massie. I mean, did they accidentally type open parentheses, 
C, close parentheses, and indent the paragraph? 

Mr. CoMEY. Oh, no. You wouldn’t accidentally type that. 

Mr. Massie. Right. Someone 

Mr. COMEY. Right. 

Mr. Massie. Someone down the chain 

Mr. CoMEY. Okay. 

Mr. Massie. So this is my question, is someone down the chain 
being investigated? Because they had the intent, clearly, if they 
had the sophistication, which Hillary Clinton, you insinuate, may 
have lacked, if they had the sophistication to know what this bore 
marking was, they had the — had to have the intent to recreate it 
or the intent to cut, copy, paste from a secure system to an unse- 
cure system. Wouldn’t that be correct? 

Mr. COMEY. Potentially, but we’re not — there’s not an open crimi- 
nal investigation of that person way down the chain at the State 
Department. 

Mr. Massie. Shouldn’t there be? 

Mr. COMEY. A criminal investigation? 

Mr. Massie. An investigation if there’s intent, which is what 
you — I mean, and I think you may be reasonable in requiring that 
threshold, but don’t we treat everybody the same, whether it’s at 
the top of the chain or the bottom of the chain? 

Mr. CoMEY. Sure. You want to if the conduct is the same. But 
we did not criminally investigate whoever started that chain and 
put the C on those paragraphs, we didn’t. 

Mr. Massie. Okay. I would suggest maybe you might want to do 
that. 

And I will yield back to the chairman. 

Chairman Chaffetz. I thank the gentleman. 

We’ll now recognize the gentlewoman from Michigan, Mrs. Law- 
rence, for 5 minutes. 

Mrs. Lawrence. Director Comey, how many years have you been 
the Director? 
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Mr. CoMEY. Two — well, 3 years. I know the exact date count, I 
think, at this point. 

Mrs. Lawrence. Okay. So how many cases have you inves- 
tigated, approximately, that you had to render a decision? 

Mr. CoMEY. The Bureau investigates tens of thousands of cases. 
The Director only gets involved in a very small number of them. 

Mrs. Lawrence. So about how many? 

Mr. CoMEY. I think I’ve been deeply involved in probably 10 to 

20. 

Mrs. Lawrence. Have you ever been called before Congress on 
any of those other decisions? 

Mr. COMEY. No, this is the first time. 

Mrs. Lawrence. Thank you. 

There are some Republicans who support you. Not surprisingly, 
they’re the ones who actually know you. 

And I have a letter here and I would like to enter into the record 
from Richard Painter, Mr. Chair. He was President Bush’s chief 
ethics lawyer. And may it be entered into the record? 

Chairman Chafeetz. She’s asking unanimous consent. Without 
objection, so ordered. 

Mrs. Lawrence. Mr. Painter refers to Mr. Comey as a man of, 
and I quote, a man of the utmost integrity, who calls the shots as 
he saw them without regard to political affiliation or friendship. 

He states, and I quote: Throughout the FBI investigation of Sec- 
retary Clinton’s email server, I have been convinced that the Direc- 
tor would supervise the investigation with being impartial and 
strict adherence to the law, as well as prosecutorial precedent. 

He also adds: Although I’m aware of very few prosecutions for 
carelessness in handling classified information as opposed to inten- 
tional disclosure, I knew that the Director would recommend pros- 
ecution in any and all circumstances where it was warranted. I 
cannot think of someone better suited to handle such a politically 
sensitive investigation. 

Finally, and I quote: I urge all Members of the United States 
Congress to stop from inferring in specific decisions, particularly 
those involving political allies or opponents. During my tenure in 
the White House, there were very unfortunate allegation that pow- 
erful senators sought politically motivating firing of a United 
States Attorney. Whether or not such allegations were true, it is 
imperative, and I’m still quoting, that members of the Senate or 
the House never again conduct themselves in a manner where such 
interference could be suspected. 

And I want to be on the record, I wholeheartedly agree with Mr. 
Painter. 

Director, you have demonstrated yourself, you sat here and an- 
swered the questions. And I would never oppose to finding the an- 
swers to any situation that is directly related to Federal agencies 
which we on this committee are responsible for. But I want to be 
clear that Congress has no business — no business — interfering with 
these types of decisions that are coming in this — in your responsi- 
bility. 

These type of attacks are not only inappropriate, but they’re dan- 
gerous. They’re dangerous because they could have a chilling effect 
on the future investigations. 
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And I asked that question, how long have you been in this posi- 
tion and how many times have you made decisions and yet were 
not pulled in 24 hours before this committee? How many times? 
And then we say it’s not political. 

And you have said repeatedly, regardless of who it was, you con- 
ducted the investigation as required under your responsibility. And 
here you have Republicans who are saying you are an honorable 
man, and till this day, I have not heard any complaints of your 
judgment. 

So I sit here today as a Member of Congress on the record that 
the slippery slope that we’re seeing today in this hearing, I want 
every Member to be cautious of what we’re saying, that in America 
when we have investigations, that we will allow our own elected 
Congress and Senate to make this a political agenda to attack, but 
only if it’s in their agenda. This goes for Democrats and Repub- 
licans. We are not here to do that. 

Thank you, and I yield back my time. 

Chairman Chaffetz. I thank the gentlewoman. 

We’ll now recognize the gentleman from Iowa, Mr. Blum. 

Mr. Blum. Thank you, Mr. Chairman. 

Thank you. Director Comey, for being here today, and thanks for 
hanging in there till every last question is answered. 

I’m not a lawyer. That’s the good news. I’m a career business- 
man. I’ve spent most of my career operating in the high-tech indus- 
try. And today I’ve heard words such as common sense, reasonable 
person, carelessness, judgment, or lack thereof. I like these words. 
I understand these words. I think the average American does as 
well. So I’d like to focus on that. 

Last Tuesday, Director Comey, you said, and I quote: “None of 
these emails should have been on any kind of an unclassified sys- 
tem, but their presence is especially concerning because all these 
emails were housed on unclassified personal servers not even sup- 
ported by full-time security staff, like those found at agencies of the 
United States Government, or even with a commercial email serv- 
ice such as Gmail.” 

Director Comey, my small Iowa business doesn’t even use Gmail 
for our email, because it’s not secure enough. I know some security 
experts in the industry. I checked with them. The going rate to 
hack into somebody’s Gmail account, $129. For corporate emails, 
they can be hacked for $500 or less. If you want to hack into an 
IP address, it’s around $100. And I’m sure the FBI could probably 
do it cheaper. This is the going rate. 

Director Comey, are you implying in that statement that the pri- 
vate email servers of Secretary Clinton’s were perhaps less secure 
than a Gmail account that is used for free by a billion people 
around this planet? 

Mr. Comey. Yes. And I’m not looking to pick on Gmail. Their se- 
curity is actually pretty good. The weakness is in the individual 
users. 

But, yes, Gmail has full-time security staff and thinks about 
patching and logging and protecting their systems in a way that 
was not the case here. 

Mr. Blum. I’d like to ask you, what kind of judgment — we talked 
a lot about judgment today — does this decision to potentially ex- 
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pose to hackers classified information on an email service that’s 
less secure than Gmail — your words — what does that suggest to 
you? What type of judgment does that suggest to you? 

Mr. CoMEY. It suggests the kind of carelessness that I talked 
about. 

Mr. Blum. In August of last year, Secretary Clinton was asked 
by Ed Henry of Fox News whether she had wiped her entire server, 
meaning did she delete all the emails on her server. Her response: 
“You mean with a cloth?” 

March of 2015, during a press conference. Secretary Clinton as- 
sured us her private email server was secure, saying the server 
was on private property guarded by the Secret Service. 

Now, this would be laughable if it wasn’t so serious. I know, you 
know, my constituents in eastern Iowa know you don’t need to be 
a cat burglar to hack into an email server and you don’t need a 
cloth to wipe a server clean. One would think that a former United 
States senator, one would think that a former secretary of state 
would know this as well. Would you agree with that statement? 

Mr. CoMEY. You would think, although as I said before, one of 
the things I’ve learned in this case is that the Secretary may not 
have been as sophisticated as people assume. She didn’t have a 
computer in her office at the State Department, for example. So I 
don’t think — so I would assume the same thing about someone who 
had been a senator and a high-ranking official. I’m not sure it’s a 
fair assumption in this case. 

Mr. Blum. In your opinion. Director Comey, did Secretary Clin- 
ton know that a server could, in fact, be wiped clean electronically 
and not with a cloth? 

Mr. Comey. Well, I assume that — I don’t know. 

Mr. Blum. Would you assume she knows that? 

Mr. Comey. I would assume that it was a facetious comment 
about a cloth, but I don’t know. I don’t know in particular on that 
one. 

Mr. Blum. Would you also assume. Director, that Secretary Clin- 
ton knew that a server could be wiped clean electronically, that it 
could be hacked electronically, not physically, you don’t need a cat 
burglar to hack a server? Would you assume — would it be reason- 
able to assume she knows that? 

Mr. Comey. To some level it would be reasonable, to some level 
of understanding. 

Mr. Blum. Then, once again, for someone who knew these things, 
or we assume to some level she knew these things, what kind of 
judgment does the decision to expose classified material on per- 
sonal servers suggest to you, what type of judgment? 

Mr. Comey. Well, again, it’s not my place to assess judgment. I 
talk in terms of a state of mind, negligence in particular. I think 
there was carelessness here, and in some circumstances extreme 
carelessness. 

Mr. Blum. Was her server hacked? 

Mr. Comey. I don’t know. I can’t prove that it was hacked. 

Mr. Blum. So that answer says to me it could have been hacked. 

Mr. Comey. Sure. Yeah. 
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Mr. Blum. And if it was hacked, potentially damaging material 
damaging to American secrets, damaging to American lives, could 
have been hacked. Could have been exposed, correct? 

Mr. CoMEY. Yeah. 

Mr. Blum. Lives could have been put at risk if that server was 
indeed hacked? 

Mr. CoMEY. I’m not prepared to say yes as to that last piece. 
That would require me going into in a way I can’t here the nature 
of the classified information. But there’s no doubt that it would 
have potentially exposed the information that was classified. The 
information was classified because it could damage the United 
States of America. 

Mr. Blum. So it could have happened. The FBI just isn’t aware? 

Mr. CoMEY. Correct. 

Mr. Blum. Thank you very much. Thank you for being here. I 
yield back the time I do not have. 

Chairman Chaffetz. Thank the gentleman. I now recognize the 
gentlelady from New Jersey, Mrs. Watson Coleman, for 5 minutes. 

Mrs. Watson Coleman. Thank you. And thank you. Director. 
I’ve got a number of questions. So I’m going to, like, zip through 
these. 

Mr. CoMEY. Okay. 

Mrs. Watson Coleman. This is a question I’m going to ask and 
you, and may not even have the answer to it because you may not 
have known this. This is about the classification marking issue 
that you’ve been asked about earlier. According to the State De- 
partment, which addressed this issue yesterday, a spokesman said 
that the call sheets appear to bear classified markings. But this 
was actually a mistake. To quote, “Generally speaking, there’s a 
standard process for developing call sheets for the Secretary of 
State. Call sheets are often marked, but it’s not untypical at all for 
them to be marked at the confidential level prior to a decision by 
the Secretary that he or she will make that call. Oftentimes, once 
it is clear the Secretary intends to make a call, the Department 
will then consider the call sheet SBU, sensitive but unclassified, or 
unclassified altogether and then mark it appropriately, and then 
prepare it for the Secretary’s use and actually marking the call.” 

“The classifications of a call sheet, therefore, is not necessarily 
fixed in time and staffers in the Secretary’s office who are involved 
in preparing and finalizing these call sheets, they understand that. 
Given this context, it appears that markings in the appropriate — 
in the documents raised in the media reports were no longer nec- 
essaiy or appropriate at the time. They were sent as an actual 
email. Those markings were human error. They didn’t need to be 
there.” Did you know this? 

Mr. CoMEY. No. 

Mrs. Watson Coleman. Thank you, Mr. Director. Can you tell 
me, based upon your information, has there been, and is there any 
evidence that our national security has been breached or at risk as 
a result of these emails, and their being on this server? Is there 
any evidence? 

Mr. CoMEY. There’s no direct evidence of an intrusion. 

Mrs. Watson Coleman. Thank you very much. I have to tell you 
that while I think that this should conclude this discussion, I know 
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we’re going to hear this issue ad nauseam. But I am concerned 
about another issue that I think really is resonating with the peo- 
ple in this country. 

And that issue has to do with experiences that we had just the 
last 2 days. Mr. Director, I want to bring this up for your consider- 
ation, because I want to ask you what can the FBI do — FBI do in 
this issue? This morning we woke up to another graphic and deeply 
disturbing video that actually brought me to tears when my staff 
played it for me wherein a Minnesota woman’s boyfriend was — has 
been shot as her young child set in the back seat after apparently 
telling the officer he was licensed to carry a weapon, he had it on 
him, and was going to reach for his identification. 

Just the other day there was an incident in Baton Rouge involv- 
ing a Mr. Alton Sterling, an African American man who was shot 
while pinned to the ground by police officers in Baton Rouge. An 
interaction tape by two bystanders with cell phones captured this. 

So I think that we have got an issue here. An issue of real na- 
tional security. And I want to ask you, Mr. Director, do we have 
an opportunity to direct our time and resources in your department 
to those issues? Is it not important that we say their names to re- 
mind people of the loss of a Tamir Rice, to an Eric Garner, to an 
Alton Sterling, to a John Crawford, III, to a Michael Brown, to a 
Walter Scott, and even a Sandra Bland? Deaths in the hands of po- 
lice custody, or by police happening. Are these not happening at an 
alarming rate? Arid is this not a legitimate space for the FBI to be 
working in? 

Mr. CoMEY. Yes, is the emphatic answer. Those are incredibly 
important matters. As you know, the FBI spends a lot of time on 
them because they — they’re very, very important. We have an in- 
vestigation open on the Baton Rouge case. I was briefed this morn- 
ing on the Minnesota case. And I would expect we’ll be involved in 
that as well. It’s an important part of our work. 

Mrs. Watson Coleman. Do you feel that you have the sufficient 
resources from the legal imperative to the funding to address these 
cases and what seems to be a disturbing pattern in our country 
today? 

Mr. CoMEY. I’m a bad bureaucrat, but I believe I have sufficient 
resources and we are applying them against those situations. Be- 
cause I believe the individual cases matter enormously, but also, 
the people’s confidence in law enforcement is one of the bedrocks 
of this great country of ours. So I have the resources, and we’re ap- 
plying them. 

Mrs. Watson Coleman. And, in addition, we believe that our 
law enforcement is, by and large, of high integrity and has the de- 
sire to keep us protected and safe. But when we find out that there 
are these occasions, and when there’s an indication that there’s a 
pattern that is taking place in this country, we have a responsi- 
bility to ensure that everyone in this country is safe. And simply 
because you’re a black man or a black woman does not make you 
a target. Thank you. I yield back my time. 

Chairman Chaffetz. Thank the gentlewoman. We’ll now recog- 
nize the gentleman from North Carolina, Mr. Walker. 

Mr. Walker. Thank you, Mr. Chairman. Thank you. Director 
Comey, for being here. A few things in this town that people agree 
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on both sides of the aisle. And one is your reputation. Reminded 
the passage in James, “Swift to hear, slow to speak, slow to wrath.” 
I am a little disappointed in some of the things that I’ve heard 
from my colleagues about some of the attacks on your character 
and your integrity. I haven’t heard those, and I hope that we have 
not experienced that. I also struggle with the change of heart that 
we’re hearing today. Because I have a list of elected officials who 
have questioned your investigation, even attacked it. In fact, the 
former President Clinton said this is a gain. In fact, just last Fri- 
day, Ms. Wasserman Schultz, Congresswoman Wasserman Schultz 
said Secretary Clinton is not the target of this investigation or 
whatever you want to call it. My question to you today is do you 
feel like this has been a Republican witch hunt? This hearing. 

Mr. COMEY. No. 

Mr. Walker. Okay. Thank you for 

Mr. CoMEY. No, I said at the beginning I understand people’s 
questions and interest. And I’m a huge fan of transparency. I think 
that’s what makes our democracy great. 

Mr. Walker. I think those are one of the reasons of why you are 
so respected. To me, this hearing is about understanding and dis- 
seminating the facts, how you saw them, and how the American 
public sees them. And specifically, in the areas of where there was 
wrongdoing admitted under your investigation, where there was 
obviously breaking the law. But also some coverups. Did Congress 
ask you to pursue this investigation? 

Mr. CoMEY. No. It was a referral from the inspector general of 
the intelligence community. 

Mr. Walker. So it wasn’t Republicans either. Was it? 

Mr. CoMEY. No. 

Mr. Walker. How did you go about collecting the evidence? 

Mr. CoMEY. We used the tools that we normally use in a criminal 
investigation. 

Mr. Walker. Did or do you receive a congressional referral for 
all the information that you collected? 

Mr. COMEY. Not to my knowledge. 

Mr. Walker. Well, then one of the things that I’m struggling 
with, or that I would like to know specifically is, under oath, Ms. 
Clinton made these three comments that we now know are untrue 
in the Benghazi hearing. Number one, she’s turned over all her 
work-related emails; number two, telling the committee that her 
attorneys went through every single email; and then finally, and 
probably the one that continues to stick the most, there was, and 
I quote, “Nothing marked classified on my emails,” end quote. Now, 
earlier, when the chairman questioned you about this, you said 
something about needing a congressional referral recommendation. 
My question is, something of this magnitude, why or can you help 
me understand, why didn’t it rise to your investigation, or someone 
bringing that to your knowledge as far as saying this is a problem, 
here she is, again. Secretary Clinton lying under oath, specifically 
about our investigation? 

Mr. CoMEY. Well, we, out of respect for the legislative branch 
being a separate branch, we do not commence investigations that 
focus on activities before Congress without Congress asking us to 
get involved. That’s a longstanding practice of the Department of 
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Justice and the FBI. So we don’t watch on TV and say: We ought 
to investigate that. You know, Joe Smith said this in front of the 
committee. It requires the committee to say: We think we have an 
issue here. Would you all take a look at it. 

Mr. Walker. But with all due respect, if you had the Secretary 
Clinton, who is under oath speaking about your very investigation, 
and you talked about your wonderful staff, and certainly have no 
reason to deny that, why wouldn’t that rise to the level of sus- 
picion? Here she is saying this under oath. I mean, lying under 
oath is a crime. Is it not? 

Mr. CoMEY. Yes. 

Mr. Walker. And what’s the penalty on that? That’s considered 
perjury, right? 

Mr. CoMEY. Perjury. It’s a felony. I forget the exact — it’s poten- 
tially years in prison. 

Mr. Walker. But I don’t understand. Would you help me under- 
stand why somebody wouldn’t have tipped you off that she’s talking 
about the very specific case under oath that you’re investigating. 

Mr. CoMEY. Well, there’s a difference between us being aware of 
testimony and us opening a criminal investigation for potential per- 
jury. Again, it’s not this case in particular, but all cases. We don’t 
do that without a committee saying we think there was an issue 
in testimony given in this separate branch of the government. 

Mr. Walker. You also mentioned earlier, and it’s been quoted 
several times that no reasonable prosecutor would move forward 
with some of the facts. Is there any room at all that somebody 
would differ a little bit on the opinion? I know that former United 
States Attorney General Michael Mukasey said would the illegal 
server disqualify her from ever holding any Federal office? So there 
are some people of high esteem that may differ, obviously not privy 
to the exact facts, but can you make any room — ^you said no reason- 
able person. Do you understand why the American people, or would 
you understand why other people may say that she has stepped 
across the line or broken enough law here that you would come to 
a different conclusion? 

Mr. COMEY. Sure. I respect different opinions. My only point is, 
and I said earlier I smile because those folks are my friends. I’ve 
worked with them for a long time. None of those guys in my posi- 
tion, I believe, knowing what I know, would think about it dif- 
ferently. But I also respect that they have a different view from the 
outside. 

Mr. Walker. Thank you, Mr. Chairman. Yield back. 

Chairman Chaffetz. I thank the gentleman. I now recognize the 
gentleman from California, Mr. DeSaulnier. 

Mr. DeSaulnier. Thank you, Mr. Chairman. Director, I just 
want to thank you as others have and I know you don’t need this, 
but I think the American people clearly need to hear it. And you’ve 
done a wonderful job today. But there are moments in my political 
life and as an American I despair for the future of this country. Not 
often. But in those moments comes an individual like yourself ei- 
ther by providence or good fortune or by the framework of the U.S. 
Constitution, and I really believe you have served this country and 
all Americans well, irrespective of their party affiliation. 
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So really two questions. Two lines of questions, I should say. One 
is, and another colleague has brought this up. But you mentioned 
in just previous testimony about the bedrock and the importance 
of public confidence in public safety institutions, yours and all. So 
I just want to give you an opportunity, I think you have responded 
to this multiple times, but give you a little more opportunity, be- 
cause I think it’s important for the American public to know that 
the system isn’t rigged, that there are people such as yourself, and 
the 15 individuals who worked on this case and others that do 
their job and believe in the Constitution of the United States. And 
if you have any further comments about comments that would say 
that the system’s rigged and Americans should give up on the sys- 
tem? 

Mr. COMEY. No, I — one of reasons I welcome this opportunity to 
have this conversation is I was raised by great parents who taught 
me you can’t care what other people think about you. Actually, in 
my business, I have to and deeply do, that people have confidence, 
that the system’s not fixed against black people, for rich people, for 
powerful people. It’s very, very important that the American people 
understand that there really are people that you pay for with your 
tax dollars who don’t give a rip about Democrats or Republicans or 
this or that, who care about finding out what is true. 

And I am lucky to lead an organization that is that way to its 
core. I get a 10-year term to ensure that I stay outside of politics. 
But in a way, it’s easy. I lead an organization that is resolutely 
apolitical. We are tough, aggressive people. If we can make a case, 
we’ll make a case. We do not care what the person’s stripes are or 
what their bank account looks like. 

And I worry very much when people doubt that. It’s the reason 
I did the press conference I did 2 days ago. I care about the FBI’s 
reputation. I care about the Justice Department. I care about the 
whole system deeply. And so I decided I’m going to do something 
no Director’s ever done before. I’m not going to tell the Attorney 
General or anybody else what I’m going to say, or even that I’m 
going to say it. They didn’t know, nor did the media know, until 
I walked out what I was going to talk about. 

And then I offered extraordinary transparency, which I’m sure 
confused and bugged a lot of people. It’s essential in this democracy 
that people see as much as they can so they can make their judg- 
ment. Again, you may — they may conclude I’m an idiot. I should 
reason differently. But what I hope they will not conclude is that 
I am a dishonest person. 

I am here trying to do the right thing in the right way. And I 
lead 36,000 people who have that as their spine. That’s what I 
want them to know. I don’t care that people agree or disagree. 
That’s what’s wonderful about our democracy. But at its core, you 
need to know there are good people trying to do the right thing all 
day long. And you pay for them, and we’ll never forget that. 

Mr. I3eSaulnier. I appreciate that. And within the context of 
these are human institutions, pretty clear to me as a nonlawyer 
that you got a bright line in terms of your decision about pursuing 
prosecution. But you did spend an extended period of time talking 
about what I think I take from you as being fairly objective anal- 
ysis of what was careless in terms of handling of it, either ascribed 
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to the former Secretary of State or to the Department. And you 
said, and I quote, during your comments, “While not the focus of 
our investigation, we also developed evidence that the security cul- 
ture of the State Department in general and respect to the use of 
unclassified email systems in particular was generally lacking in 
the kind of care for classified information found elsewhere in the 
government.” That’s accurate. Isn’t it? 

Mr. CoMEY. Yes, sir. 

Mr. DeSaulnier. So struggling with this, and this is in the con- 
text of this hearing. Oversight and State Department, and this 
committee, as to how do we go from here and be clearer about how 
the State Department, we’ll talk about this with the IG, and some 
of the comments that former Secretary Powell has made, including 
that the absurdity of the retroactive classification. And now we 
have 1,000 of these emails from Secretary Clinton that’s out in the 
public and are being spread even further. 

So there are other people involved. Sitting there, how does this 
committee go forward to make sure that the State Department can 
still function in the way it does with human beings and have con- 
versations that are both transparent but also national security? 
What are the things we need to do to make sure that this doesn’t 
happen again? 

Mr. COMEY. Well, I think a good start — I think the reason the 
chairman has the IG from the State Department here is to start 
that conversation. The IG knows deeply the culture of a Depart- 
ment, and is far better equipped than I to say you ought to focus 
here, you ought to focus there to make it better. So I think that’s 
place to start. 

Mr. DeSaulnier. Thank you, Mr. Director. I yield back. 

Chairman Chaffetz. Thank you. We’ll now recognize the gen- 
tleman from Tennessee, Mr. DesJarlais, for 5 minutes. 

Mr. DesJarlais. Director Comey, thank you for appearing so 
quickly on short notice. I think it’s really important that you’re 
here. Because of the way you laid out the case on Tuesday, there 
is a perception that you felt one way and then came to another con- 
clusion. I, like many of my colleagues, put a post up back in my 
district and let them know you were coming. And in less than 24 
hours, I had 750 questions sent to ask you. 

So, again, thank you for being here. But a common theme, just 
to summarize, a lot of those concerns were that in this case, Clin- 
ton was above the law. That there was a double standard. And a 
lot of that was based on the way you presented your findings. Now, 
your team, you said you did not personally interview her on Satur- 
day but your team did for about 3-1/2 hours, correct? 

Mr. Comey. Yes. 

Mr. DesJarlais. Okay. Do you know in reading the review or the 
summary, did they ask Hillary Clinton about her comment that she 
had never sent or received classified information over private 
email? 

Mr. Comey. I think so. But I can’t — I can’t remember specifically. 

Mr. DesJarlais. Okay. 

Mr. Comey. It’s a very long 302. I’d have to check. 
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Mr. DesJarlais. And we’ll get access to that. Do you know if 
they asked her when she said that there was nothing marked clas- 
sified on my email sent or received? 

Mr. CoMEY. Same answer. I’m not sure. 

Mr. DesJarlais. Okay. And so the same answer then when she 
said, “I did not email any classified material to anyone on my 
email. There is no classified material.” You don’t know whether 
they asked her that? 

Mr. Comey. I don’t know whether they asked her that question. 
The entire interview was going — was focused on so what did you 
know, what did you see, what is this document. That kind of thing. 

Mr. DesJarlais. Do you know if they asked her whether she 
stands by the fact that she said she just used one device and that 
was for her convenience? 

Mr. Comey. I don’t know. I know they established from talking 
to her she used many devices during here 4 years. So I don’t know 
whether they asked her specifically about that statement. 

Mr. DesJarlais. Okay. I guess my 

Mr. Comey. That’s easy to check, though. 

Mr. DesJarlais. I guess my point is, you’re trying to get inside 
the head of Hillary Clinton in this investigation and know whether 
there was intent. And so we all know what she told the people. 
That’s been well-documented. She said that she did not do those 
things, that she did not send or receive classified emails, that she 
used one server and one device for her convenience, and since then, 
I think even in your statement you recognize that those were not 
correct. Is that fair? 

Mr. Comey. I really don’t want to get in the business of trying 
to parse and judge her public statements. And so I think I’ve tried 
to avoid doing that sitting here. 

Mr. DesJarlais. Why do you feel that’s important? 

Mr. Comey. Because what matters to me is what did she say to 
the FBI. That’s obviously first and foremost for us. 

Mr. DesJarlais. Right. Honest people don’t need to lie. Is that 
right? 

Mr. Comey. Honest people don’t need to lie? I hope not. 

Mr. DesJarlais. Okay. Well, in this case, for some reason, she 
felt the need to misrepresent what she had done with this server 
all throughout the investigation. And you guys, after a year, 
brought her in on Saturday. And in 3-1/2 hours, came out with the 
conclusion that she shouldn’t be prosecuted because there was no 
intent. Is that right? 

Mr. Comey. No. 

Mr. DesJarlais. Okay. So I don’t want to put words in your 
mouth, but is it fair to say that your interpretation of Hillary Clin- 
ton’s handling of top secret information and classified documents 
was extremely careless? 

Mr. Comey. Yes. 

Mr. DesJarlais. And is it fair to say that you said that you went 
on to define “extremely careless” that Hillary Clinton’s handling of 
top secret information was sloppy or represented sloppiness? 

Mr. Comey. Yeah. That’s another way of trying to express the 
same concept. 
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Mr. DesJarlais. Okay. And then just a few minutes ago, you 
also stated that you now believe that Hillary Clinton is not nearly 
as sophisticated as people thought. Is that correct? 

Mr. CoMEY. Yeah. I think that’s fair, actually. No, not as people 
thought, hut as people would assume about somebody with that 
background. I’m sorry. I should be clear about this. Technically so- 
phisticated. I’m not opining in other kinds of sophistication. 

Mr. DesJarlais. All right. In the last minute. Director, I want 
to talk a little bit about precedent. Because I think my colleague. 
Trey Gowdy, made a great point that there still is really no prece- 
dence in terms of punishment for this type of behavior. Are you fa- 
miliar with Brian Nishimura’s case? 

Mr. CoMEY. Yes. 

Mr. DesJarlais. Okay. He’s a Naval Reservist for those who 
don’t know. And he was prosecuted. What is the difference between 
his case and Hillary Clinton’s case in terms of extremely careless- 
ness and gross negligence, because we’re dealing with statute 793, 
section (D, where it does not require intent. Is that correct? 

Mr. COMEY. I’m sorry. 793(D is the gross negligence standard. 

Mr. DesJarlais. Right. And is that why Brian Nishimura was 
punished? 

Mr. CoMEY. No. Nishimura was prosecuted under the mis- 
demeanor statue 1924 on facts that are very different. If you want 
me to go through them. I’ll go through them, but very different 
that 

Mr. DesJarlais. Okay. I think that there’s been a review of this 
case, and they’re very similar. And that’s why people feel that 
there’s a double standard. 

Mr. CoMEY. What they’re reading in the media is not a complete 
accounting of the facts in that case. 

Mr. DesJarlais. Well, would you agree, then, with Representa- 
tive Gowdy that there still is really no precedence for punishing 
someone like Hillary Clinton and she could really go in — poten- 
tially be elected President and do this again without fear of being 
punished? 

Mr. COMEY. I don’t think I’m qualified to answer that question. 

Mr. DesJarlais. My time’s expired. Thank you for your time. 

Chairman Chafeetz. Thank the gentleman. I now recognize the 
gentlewoman from New Mexico, Ms. Lujan Grisham. 

Ms. Lujan Grisham. Thank you, Mr. Chairman. I’ve had the 
benefit of when you’re last, or nearly last to really have both the 
benefit and then the question, the kinds of statements and the dia- 
logue back and forth. And where I am settled at this point in time 
is in a couple of places. But particularly, I don’t think there’s any 
member in this committee or, quite frankly, any Member in Con- 
gress who doesn’t both want and expect that the FBI and the De- 
partment of Justice to be and to operate in a fair, unbiased, highly 
independent manner. Otherwise, you can’t appropriately uphold or 
enforce Federal law. And while we have all — this has been stated 
in a couple of different ways. I’m going to see if we can’t — I want 
to get direct answers. 

So, Mr. Comey, is there any evidence, given that that’s the stand- 
ard that we all want, desire, and expect, to suggest that Hillary 
Clinton was not charged by the Department of Justice due to inap- 
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propriate political influence, or due to her current or previous pub- 
lic positions? 

Mr. CoMEY. Zero. And if there is such evidence, I’d love folks to 
show it to me. 

Ms. Lujan Grisham. In that regard, was there a double stand- 
ard? 

Mr. COMEY. No. In fact, I think my entire goal was to avoid a 
double standard, to avoid what sometimes prosecutors call celebrity 
hunting and doing something for a famous person that you would 
never do for an ordinary Joe or Jane. 

Ms. Lujan Grisham. Thank you. And I really appreciate that 
you’re here today, and explaining the process in great detail, frank- 
ly, and I’ve — this committee works at getting specific detail about 
a variety of reviews, investigations, policies, concepts throughout 
Federal Government. And I think I can say that this committee 
often finds that we don’t get very much clarity or specific responses 
to the majority of questions that we ask. So I really appreciate 
that. And that in explaining that what led the FBI to conclude that 
Hillary Clinton should not be charged. 

Saying that, however. I’m still concerned, frankly, that the use 
of this hearing and some of the public statements made by elected 
officials accusing the Department of Justice of using a double 
standard without any evidence at all to support that statement, 
leaning on accusations of such, in fact, jeopardizes the very thing 
that we want the most, which is an apolitical and independent De- 
partment of Justice. And we have every right to ask these tough 
questions. 

And to be clear that the process that you use for everyone, in- 
cluding elected officials, works. And that there’s a responsibility 
not to substitute your own political preferences to the outcome of 
an independent and apolitical Department of Justice investigation 
on any level, whether it involves Hillary Clinton or anybody else. 
Do you agree with that general statement? 

Mr. CoMEY. Yes. 

Ms. Lujan Grisham. For me, that’s a really important ethical 
line that I believe should never be crossed. I worry that some of 
what we did today could be, frankly, interpreted as violating that 
very standard. And for that, I certainly want the American people 
and my constituents who are watching to understand that very im- 
portant line, and to be sure that our responsibility is better served 
making sure that we do have, in fact, an independent body whose 
aim it is to bring about truth and justice and uphold the Federal 
law. And, sir, based on eveiything that you’ve said today, I don’t 
see any reason to disagree with your statements, your assessments, 
or the explanation of that process. 

With the little time I do have left, I do want to say that given 
that some of the classified material that we have both debated and 
talked about today can be classified later or up-classified, or that 
other agencies have different determinations of what constitutes 
classified and not. I do think that’s a process that warrants refin- 
ing. And if something can come out of this hearing about making 
sure that we do something better in the future for everyone, not 
just appointed or elected officials, that that ought to be something 
that we do. 
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I’m often confused by some of the things that are clearly told to 
us in a classified briefing that appear to be different or already out 
in the public in some way. And I’m not sure who’s making those 
decisions. I honor my responsibility to the highest degree, but I 
think that’s a process that could use some significant refining, and 
that’s my only suggestion, sir. Thank you for being here today. 

Mr. COMEY. Thank you. 

Chairman Chaffetz. Thank the gentlewoman. We’ll now recog- 
nize the gentleman from Georgia, Mr. Carter, for 5 minutes. 

Mr. Carter. Thank you, Mr. Chairman. And, Director Comey, 
thank you for being here today. I appreciate it. I’m over here. And 
I’m going to be real quick and try to be succinct. I want to clarify 
some things that you said. And, look, I don’t want to go over every- 
thing that everybody’s been through today. I mean, we’ve had some 
great questions here that have asked you about you said this, she 
said that. Representative Gowdy made a great case of, you know, 
this is what she said under oath and publicly, and yet you dispute 
that and say. No, this is the case. But, look. I’ve just got a couple 
of questions. Okay? First of all, did I understand you correctly that 
your decision — that this decision was made within 3-1/2 hours of 
an interview and that was all? 

Mr. Comey. No. We investigated for a year. 

Mr. Carter. But you interviewed her for 3-1/2 hours last week 
and then came to the conclusion? 

Mr. Comey. Correct. We interviewed her on Saturday for 3-1/2 
hours. The last step of a yearlong investigation. 

Mr. Carter. Now, as I understand it, Hillary Clinton has testi- 
fied that the servers that she used were always safe and secure. 
Yet you refute that and say. No, that is not the case at all. Were 
they ever secure? Were the servers that she were using, were they 
ever secure? 

Mr. Comey. Well, the challenge, security’s not binary. It’s just 
degrees of security. It was less security than, one, at the State De- 
partment, or, as I said, even one at a private commercial provider, 
like a Gmail. 

Mr. Carter. Well, let me ask you this: She’s got staff and she’s 
got people around her. Did they know she was doing this? Did they 
know that she was using these other devices? Did anybody ever 
bring it to her attention and say. Hey, you’re not supposed to be 
doing that? 

Mr. Comey. I think a lot of people around the Secretary under- 
stood she have was using a private personal email setup. 

Mr. Carter. Then why didn’t they say something? Don’t they 
have a responsibility as well? 

Mr. Comey. That’s an important question that goes to the culture 
of the State Department that’s worth asking. 

Mr. Carter. I mean, look, we all surround ourselves with good 
people and we depend on them to help us. I don’t understand — 
should they be held responsible for that, for not bring that to some- 
one’s attention? If I see someone who’s breaking — who’s not fol- 
lowing protocol, is it my responsibility to report them? 

Mr. Comey. Yes. 

Mr. Carter. Well 
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Mr. CoMEY. Especially when it comes to security matters. You 
have an obligation to report a security violation that you may wit- 
ness, whether it’s involving you or one of your co-workers. But this 
is about so 

Mr. Carter. What about Bryan Pagliano? Did he ever know? Do 
you know if he knew that she was not following proper protocol 
here? 

Mr. CoMEY. He helped set it up. 

Mr. Carter. He helped set it up. So obviously he knew. 

Mr. CoMEY. Yeah. Obviously, he knew that 

Mr. Carter. Okay. Is anything going to be done to him? Any 
prosecution or any discipline, any 

Mr. Comey. I don’t know about discipline, but there’s not going 
to be a prosecution of him. 

Chairman Chaffetz. Will the gentleman yield? 

Mr. Carter. I yield. 

Chairman Chaffetz. My understanding. Director, is that you of- 
fered him immunity. Why did you offer him immunity, and what 
did you get for it? 

Mr. Comey. Yeah. That I have to — I’m not sure what I can talk 
about in open setting about that. 

Chairman Chaffetz. Well, he’s not going to be prosecuted. 
So 

Mr. Comey. Right. But I want to be careful. I’m doing this 24 
hours after the investigation closed. I want to be thoughtful be- 
cause we’re, as you know, big about the law, that I’m following the 
law about what I can disclose about that. So I’ll have to get back 
to you on that one. I don’t want to answer that off the cuff. 

Mr. Carter. Director Comey, I am not a lawyer. I’m not an in- 
vestigator. I’m a pharmacist. But I’m a citizen. And citizens are 
upset. I watched, with great interest, last — earlier this week when 
you laid out your case. And I’m telling you, you laid it out, bam, 
bam, bam. Here’s what she did wrong, wrong, wrong, wrong. And 
then all of a sudden, you used the word “however.” And it was like 
you could hear a gasp throughout the country of people saying. Oh, 
here we go again. Do you regret presenting it in a way like that? 

Mr. Comey. No. And I’m highly — I think I didn’t use the word 
“however.” I try never to use that in speaking. But I did lay it out, 
I thought, in the way that made sense and that I hoped was max- 
imum transparency for people. 

Mr. Carter. I’m sorry, but that’s the point. It didn’t make sense. 
The way you were laying it out it would have made sense and the 
way that the questions have been asked here and we’ve made all 
these points of where she was — obviously told lies under oath, that 
it would have been. Okay, we finally got one here. 

Mr. Comey. I think it made sense. I just hope folks go back 
maybe with a cup of tea and open their minds and read my state- 
ment again carefully. But again, if you disagree, that’s okay. 
But 

Mr. Carter. But when we — look. I’ve only been here 18 months. 
And I want to tell you, this inside-the-beltway mentality, no won- 
der people don’t trust us. 

Mr. Comey. I have — I know who you’re talking about. I have no 
kind of inside-the-beltway mentality. 
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Mr. Carter. But this is an example of what I’m talking about 
here. It just as a nonlawyer, as a noninvestigator, it would appear 
to me you have got a hell of a case. 

Mr. CoMEY. Yeah. And I’m telling you we don’t. And I hope peo- 
ple take the time to understand why. 

Mr. Carter. Mr. Chairman, I yield back. 

Chairman Chafeetz. Thank the gentleman. I will now recognize 
the gentleman from Arizona, Mr. Gosar. Oh, let’s go ahead and go 
to the gentleman from South Carolina, Mr. Mulvaney, first. 

Mr. Mulvaney. Thank the gentleman. Director Comey, earlier 
today you heard a long list of statements that Mrs. Clinton has 
made previously, both to the public and to Congress that were not 
factually accurate. I think you went down the whole long list. 
When she met with you folks on Saturday last week, I take it she 
didn’t say the same things at that interview? 

Mr. Comey. I’m not equipped sitting here without the 302 in 
front of me to answer in that broad 

Mr. Mulvaney. But it’s your testimony 

Mr. Comey. I have no basis that — we do not have a basis for con- 
cluding she lied to the FBI. 

Mr. Mulvaney. Gotcha. Did anybody ask her on Saturday why 
she told you all one thing and told us another? 

Mr. Comey. I don’t know as I sit here. I mean. I’ll figure that 
out 

Mr. Mulvaney. Would that have been of interest to you in help- 
ing to establish intent? 

Mr. Comey. It could have been, sure. 

Mr. Mulvaney. More importantly, I think, did anybody ask her 
why she set up the email system as she did in the first place? 

Mr. Comey. Yes. 

Mr. Mulvaney. And the answer was convenience? 

Mr. Comey. Yeah. It was already there. It was a system her hus- 
band had. And so she just jumped onto it. 

Mr. Mulvaney. Were you aware that just earlier this week, her 
assistant actually said it was for an entirely different reason? It 
was to keep emails from being accessible, and that it was for con- 
cealment purposes? And Huma Abedin was asked in her deposition 
why it was set up. And it was said to keep her personal emails 
from being accessible. The question, to whom. To anybody. Were 
you aware of that testimony? 

Mr. Comey. Generally, yes. 

Mr. Mulvaney. Okay. So here’s sort of the summary I take from 
what we’ve done today, which is that over the course of the entire 
system, what she did, she intentionally set up a system. According 
to your testimony, your findings, she was careless regarding its 
technical security. I think you’ve said that even a basic free ac- 
count, a Gmail account had better security than she had. And she 
did that, according to her own staffer’s sworn deposition for the 
purpose of preventing access to those emails. As a result of this, 
she exposed top secret information to potential hack by foreign ac- 
tors. You’ve seen the emails, we have not. I think you’ve said ear- 
lier that the emails could be of the sort that would put national se- 
curity at risk, and I think we had testimony earlier that got you 
acknowledge that it might even put our agents overseas at risk. 
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Mr. COMEY. Yeah. I don’t think I agree with that. But it’s still 
important. 

Mr. Mulvaney. Okay. All right. She kept all of that secret until 
after she left the State Department. She lied about it, or at least 
made untrue statements about it after it finally came to light. She, 
thereafter, ordered the destruction of evidence, evidence that was 
destroyed so thoroughly that you folks could not do an adequate re- 
covery. Yet she receives no criminal penalty. So I guess this is my 
question to you: Are we to assume, as we sit here today, that if the 
next President of the United States does the exact same thing, on 
the day he or she is sworn into office, sets up a private email serv- 
ice for the purpose of concealing information from the public or 
from anybody, that as a result of that, potentially exposes national 
security level information to our enemies, lies about it, and then 
destroys the evidence during an investigation, that there will be no 
criminal charges if you’re the FBI Director against that person? 

Mr. CoMEY. That’s not a question the FBI Director should an- 
swer. I mean 

Mr. Mulvaney. No, I’m asking if she does the exact same thing 
as President as she’s done today, your result will be the exact same 
as it was 48 hours ago. There will be no criminal findings, right? 

Mr. CoMEY. If the facts were exactly the same? 

Mr. Mulvaney. Right. 

Mr. CoMEY. And the law was exactly the same? 

Mr. Mulvaney. Right. 

Mr. CoMEY. Yeah. The result would be the same. 

Mr. Mulvaney. And I guess under the theory that if the law is 
to be equally applied to everybody, that if a White House staffer 
does the exact same thing for the exact same purpose and exposes 
the exact same risks, that there will be no criminal action against 
that person. There could be, as you’ve mentioned, administrative 
penalties. There are no administrative penalties, as I understand 
it, by the way, against the President. Correct? 

Mr. COMEY. I don’t think so. But I’m not a 

Mr. Mulvaney. I don’t think there are either. I don’t think you 
can take away the President’s top security clearance. And I’m pret- 
ty sure you can’t fire the President because we’ve tried. Not only 
would a staffer not have any criminal charges brought against him, 
but I suppose a summer intern could do the exact same thing 
under the theory that we’re going to apply the law equally regard- 
less of who the people are. My question to you is this: And it’s not 
a legal question. I guess it’s a commonsense, ordinary question that 
folks are asking me. From a national security standpoint, some- 
body who used to lecture on that, does that bother you? 

Mr. COMEY. The mishandling of classified information bothers 
me no matter what circumstance it occurs in. Because it has na- 
tional security implications. 

Mr. Mulvaney. Does it bother you that the precedent that you 
are setting today may well lead to a circumstance where our top 
secret information continues to be exposed to our potential en- 
emies? 

Mr. Comey. No, in this sense. The precedent that I’m setting 
today is my absolute best effort to treat people fairly without re- 
gard to who they are. If that continues to be the record of the FBI 
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and the Justice Department, that’s what it should be. The rest of 
the implications in your question are beyond that. They’re impor- 
tant, but they’re not for the FBI to answer. We should aspire to be 
apolitical, facts and the law, treat Joe the same as Sally as Sec- 
retary so-and-so. That’s my goal. 

Mr. Mulvaney. If you had come to a different decision — by the 
way, I tend to agree with everything you’ve just said. If you had 
come to a different decision, do you think that would have a dif- 
ferent precedential value that would keep our information more 
safe? 

Mr. CoMEY. If we decided to recommend criminal charges here? 

Mr. Mulvaney. Yes, sir. 

Mr. COMEY. I don’t know. That’s a good question. I don’t know. 
I could argue it both ways. I guess I’m a lawyer, I can argue every- 
thing both ways. But I could argue that both ways. 

Mr. Mulvaney. Thank you. Director Comey. Thank you, Mr. 
Chairman. 

Chairman Chaffetz. Thank the gentleman. Now recognize the 
gentleman from Arizona, Mr. Gosar, for 5 minutes. 

Mr. Gosar. Thank you, Mr. Chairman. Thank you, Mr. Comey, 
for being here. My colleague alluded to Bryan Pagliano, the IT ad- 
viser. And were you made aware of the deal of immunity with him? 

Mr. Comey. I am aware. 

Mr. Gosar. Now that Attorney General Lynch has stated that 
there will be no charges, there’s many that suspect that he failed 
to answer questions in his congressional deposition, that he had 
something to hide. Why did your investigators at the DOJ decide 
it was necessary to offer Mr. Pagliano immunity? 

Mr. Comey. As I said in response to the earlier question, I need 
to be more thoughtful about what I say about an immunity deal 
in public. It may be totally fine. I just don’t want to screw up be- 
cause we’re doing this so quickly. In general, I can answer, because 
I’ve done it many times as a prosecutor. You make a grant of im- 
munity in order to get information that you don’t think you could 
get otherwise. 

Mr. Gosar. But you know that there may be something there in 
hindsight, right? You’re looking ahead because of the pertinent in- 
formation this person possesses. 

Mr. Comey. Right. You believe they have relevant information to 
the investigation. 

Mr. Gosar. So did the investigators draft an interview report 
known as a 302 with Mr. Pagliano? 

Mr. Comey. Yes. 

Mr. Gosar. Given the importance of this case, will you commit 
to voluntarily disclosing the 302s for review of Bryan Pagliano and 
other witnesses interviewed as part of your investigation? 

Mr. Comey. I’ll commit to giving you everything I can possibly 
give you under the law, and to doing it as quickly as possible. That 
said, that means I got to go back and sort it out. For example, the 
302 of Secretary Clinton is classified at the TS/SCI level. So we got 
to sort through all that. But we’ll do it quickly. 

Mr. Gosar. Yeah. I know you’ve done this, because you’ve done 
this for Lois Lerner and other cases. So we would expect that. 
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Now, Director Comey, Hillary Clinton testified before Congress 
and told the American people multiple times that she never 
emailed any classified information to anyone on her private email 
servers. Your investigation revealed 110 of Clinton’s emails, and 52 
email chains confined classified information. Clinton told the Amer- 
ican people, and I quote, “The laws and regulations in effect when 
I was Secretary of State allowed me to use my email for work. This 
is undisputed,” end of quote. Your investigation revealed that that 
also wasn’t true. 

Clinton claimed she turned over all her work-related emails. 
Your investigation revealed that this wasn’t also true. Clinton 
claimed that there was no security breaches and her private serv- 
ers had numerous safeguards. Your investigation revealed eight 
email chains on Clinton’s private servers containing top secret in- 
formation. And that is was possible, quote, “hostile actors gained 
access to sensitive information.” Further, multiple people she 
emailed with regularity were hacked by hostile actors and her pri- 
vate servers were less secure than a Gmail account, making a secu- 
rity breach all the more likely. 

Director Comey, it’s a Federal crime, as you know, to mishandle 
classified information in a grossly negligent way. And you stated 
Clinton and her colleagues were extremely careless. Clinton has 
publicly stated she was well aware of the classification require- 
ments, yet she broke the law anyway. Multiple people have been 
prosecuted for less. And there is a growing trend of abuses in sen- 
ior level employees. The only difference between her and others is 
her total resistance to acknowledge her irresponsible behavior that 
jeopardized our national security and the American people. 

I think you should have recommended Clinton be prosecuted 
under section 793 or section 1024 of Title 18. If not, who? If not 
now, when? Your recommendation deprived the American people of 
the opportunity for justice in this matter. There shouldn’t be double 
standards for the Clintons, and they shouldn’t be above the law. 
With that. I’m going to yield the rest of my time to the gentleman 
from South Carolina, Mr. Gowdy. 

Mr. Gowdy. Thank you. Dr. Gosar. Director Comey, I want to go 
back to the issue of intent for just a second. We can disagree on 
whether or not it’s an element of the offense. Let’s assume, for the 
sake of argument, that you’re right and I’m wrong, and that it is 
an element of the offense. Secretary Clinton said that she was, 
quote, “Well aware of classification requirements.” Those are her 
words, not mine and not yours. So if she were, quote, “well aware 
of classification requirements,” how did that impact your analysis 
of her intent. Because I’ve heard you this morning describe her as 
being less than sophisticated. She disagrees with that. 

Mr. Comey. Well, I was talking about technical sophistication. 
The question is — I would hope everybody who works in the govern- 
ment is aware of classification requirements. The question then is 
if you mishandle classified information, when you did that thing, 
did you know you were doing something that was unlawful. That’s 
the intent question. 

Mr. Gowdy. Well, you and I are going to have to get together 
some other time and discuss all the people we prosecuted who were 
unaware that they were breaking the law. There are lots of really 
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dumb defendants out there who don’t know that what they’re doing 
is against the law. But let’s go with what you say. 

Mr. CoMEY. I disagree. You may have prosecuted a lot of those 
folks. I did not prosecute a lot of those folks 

Mr. Gowdy. Well, I was a gutter prosecutor and you were a 
white collar prosecutor. Trust me. There are lots of people who 
don’t know you can’t kill other people. Let me ask you this: On the 
issue of intent, you say it was convenience. Okay? You’re a really 
smart lawyer. If it were convenience. Director, she wouldn’t have 
waited 2 years to return the documents. And she wouldn’t have de- 
leted them 4 years after they were created. So you can’t really be- 
lieve that her intent was convenience when she never turned them 
over until Congress started asking for them. Could you? 

Mr. COMEY. You know, my focus, and I hope I made this 
clear.My focus was on what was the thinking around the classified 
information. I mean, it’s relevant why the system was set up and 
the thinking there. But she didn’t — I don’t understand her to be 
saying — well, I think I’ve said it already. But that’s my focus. 

Mr. Gowdy. So I know I’m out of time, but it just strikes me you 
are reading a specific intent element into a gross negligence stat- 
ute. Not even general intent. 

Chairman Chaefetz. The gentleman’s time 

Mr. Gowdy. A specific intent 

Chairman Chaefetz. The gentleman’s time has expired. 

Mr. COMEY. Sorry. 

Chairman Chaefetz. The Director can answer. 

Mr. COMEY. I enjoy talking with him. The question you got to ask 
is so why is it that the Department of Justice, since 1917, has not 
used that gross negligence statute but charging it once in an espio- 
nage case. And whether their decision was smart or not, that is the 
record of fairness. And so you have to decide, do I treat this person 
against that record? And if I do, is that a fair thing to do, even if 
you’re not worried about the constitutionality of it? And my judg- 
ment is no reasonable prosecutor would do that. That would be ce- 
lebrity hunting. That would be treating this person differently than 
John Doe. 

Chairman Chaefetz. Director, I want to follow up on that. Why 
did you do what you did? You know, my interpretation of what the 
FBI is supposed to be doing is come to a determination of the facts. 
And then turn it over to a prosecutor. You were a prosecutor. But 
you’re not a prosecutor now. 

Mr. COMEY. Right. 

Chairman Chaefetz. It is unprecedented that an FBI Director 
gave the type of press conference that he did and took a position 
that an unreasonable prosecutor would only take this case forward. 
Why did you do that? 

Mr. CoMEY. Yeah. It’s a great question. The — everything I did 
would have been done privately in the normal course. We have 
great conversations between the FBI and prosecutors. We make 
recommendations. We argue back and forth. What I decided to do 
was offer transparency to the American people about the whys of 
that what I was going to do because I thought that was very, very 
important for their confidence in the system of justice. And within 
that, their confidence in the FBI. And I was very concerned if I 
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didn’t show that transparency, that in that lack of transparency 
people could say, Gees. What’s going on here? Something — you 
know, something seems squirrely here. And so I said I will do 
something unprecedented because I think this is an unprecedented 
situation. 

Now, the next Director who is criminally investigating one of the 
two candidates for President may find him or herself hound by my 
precedent. Okay. So if that happens in the next 100 years they’ll 
have to deal with what I did. So I decided it was worth doing. 

Chairman Chaffetz. Mr. Cummings. 

Mr. Cummings. Mr. Director, I have just one question. You know. 
I’ve been sitting here listening to this. And I really — this is some- 
thing that bothered me in the Lois Lerner case, and it bothers me 
in this case. And I’m just wondering your opinion. Mrs. Lawrence 
had talked about this, the chilling effect of your having to come 
here and justify your decisions. And I know that you’ve been really 
nice, and you just explained why you did what you did, and I’m 
glad you’re doing it. But, you know, do you at all, and, I mean, tak- 
ing off — I’m just talking about here you’ve got people making deci- 
sions and then being pulled here in the Congress to then say, okay, 
to be questioned about the decisions. At what point — or do you 
even think about it becoming a chilling effect? Because most peo- 
ple, you know, when their decision’s made, don’t get this kind of 
opportunity, as you well know. There are no statements. You know, 
they either get indicted or they’re not. 

So I noted you see this as a special case. And I wonder whether 
you agree with Mrs. Lawrence that we may be just going down a 
slippery slope. That’s all I want to ask. 

Mr. COMEY. And my honest answer is I don’t think so. As I — 
when I talked to the chairman, I agreed to come because I think 
the American people care deeply about this. There’s all kind of 
folks watching this at home or being told. Well, lots of other cases 
were prosecuted and she wasn’t. I want them to know that’s not 
true. And so I want to have this conversation. And I actually wel- 
come the opportunity. Look, it’s a pain. I’ve had to go to the bath- 
room for about an hour, but it is really 

Chairman Chaffetz. Don’t worry. We’re halfway done. So 

Mr. CoMEY. It is really important to do. Because this is an un- 
precedented situation. Transparency is the absolute best thing for 
me and for democracy. 

And I realize, Mr. Chairman, my folks told me I screwed up one 
fact that I should fix. I was misremembering. In the Petraeus case, 
we didn’t find the notebooks in the attic, we found it in his desk. 
So I wanted to make sure I was fair to him about that. 

But I really don’t think so. I don’t think it has a chilling effect. 
Again, if there’s another presidential candidate being investigated 
by the FBI, maybe they’ll be bound by this. Lord willing, it’s not 
going to happen again. Certainly I have 2,619 days left in this job. 
I won’t happen on my term. But if does, I won’t be chilled. 

Chairman Chafeetz. Thank the gentleman. If we need a human- 
itarian break, just give me the cue, but 

Mr. CoMEY. No. I feel like we’re almost done, though. 

Chairman Chaffetz. We’re on the right trajectory, yes. 
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But we would like to recognize the gentleman from Alabama, Mr. 
Palmer, for 5 minutes. 

Mr. Palmer. Thank you, Mr. Chairman. Director Comey, your 
statement on Tuesday indicated that Secretary Clinton and her col- 
leagues send and received emails marked classified on an unse- 
cured private email server that may or may not have been hacked 
by a foreign power. Are you aware that teenage hackers hacked the 
personal email accounts of CIA Director John Brennan, the Direc- 
tor of U.S. National Intelligence, James Clapper, and FBI Deputy 
Director Mark Giuliano? 

Mr. Comey. I am intensely aware. They didn’t hack in the way 
we normally think of it, but that they, by trickery, got access to 
their accounts. 

Mr. Palmer. The point I want to make is that these were per- 
sonal — commercially protected personal email accounts that con- 
tained no classified information. Yet Mrs. Clinton used her per- 
sonal email, not a commercial account, on a server in her basement 
without even this basic protection, and transmitted classified infor- 
mation through that account. If teenagers in England were able to 
hack the personal email accounts of the Director of the CIA, the Di- 
rector of IJ.S. National Intelligence, and the Deputy Director Of the 
FBI, does it concern you that sophisticated hackers or hackers 
working for foreign interests never attempted — I mean, does it 
seem reasonable that they never attempted, or were never success- 
ful in hacking Mrs. Clinton’s personal email accounts or one of her 
devices? 

Mr. Comey. No. It concerns me a great deal. And that’s why we 
spent so much time to see if we could figure out — see fingerprints 
of that. 

Mr. Palmer. Well, you said in your statement regarding your 
recommendation not to prosecute, “To be clear, this is not to sug- 
gest that in similar circumstances, a person who engaged in this 
activity would face no consequences. To the contrary, these individ- 
uals are often subject to security or administrative sanctions, but 
that is not what we’re deciding here.” Do you stand by that? 

Mr. Comey. Yes. 

Mr. Palmer. Okay. I thought you would. You also said you could 
not prove intent. I don’t want to — I want to touch on a couple 
things here. One, a reasonable person would not have compromised 
classified information by keeping that information on inadequately 
secure private devices. In other words, such a person would be 
viewed as unreasonable and unsuitable for any position in our gov- 
ernment that included any responsibility for handling and pro- 
tecting classified information. Would you agree? 

Mr. Comey. I would agree it would be negligent. I can’t prejudge 
a suitability determination, but it would definitely be stared at 
very hard. 

Mr. Palmer. Well, let me tell you why I bring this up. I sat here 
next to Mr. Hurd, who served our country valiantly. Put his life on 
the line. And I don’t know if you could sense the passion and inten- 
sity of his questions, because he knows people whose lives are on 
the line right now. And in regard to his questions, if someone, a 
U.S. intelligence agent had their mission compromised, or worse, 
had been killed or injured or captured because of the carelessness 
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of someone responsible for protecting classified information, would 
intent matter at that point? 

Mr. CoMEY. In deciding whether to prosecute the person? Of 
course. But — ^yeah. That’s the answer. Of course it would. It 
would — the matter would be deadly serious. But the legal stand- 
ards would be the same. 

Mr. Palmer. Well, what we’re dealing with in this hearing is not 
the lack of due diligence in handling routine government data or 
information, but the lack of due diligence by Secretary Clinton and 
her carelessness in handling classified information that could have 
compromised American national security, and as Mr. Hurd pointed 
out, the missions and personal safety of our intelligence agents. 
That troubles me greatly. 

And I think the issue here — and I do respect you. I have spoken 
in your defense many times, at this point, to my detriment. But I 
do believe that your answers are honest and factual. But based on 
your answers regarding Mrs. Clinton’s use of the email, and based 
on what we know, it seems to me that she is stunningly incom- 
petent in her understanding of the basic technology of email, and 
stunningly incompetent in handling classified information. I mean, 
you should never associate the Secretary of State and classified in- 
formation with the word “careless.” It doesn’t matter. I mean, we 
have to exercise the utmost due diligence. All of us in this com- 
mittee do in handling this. You do in prosecuting cases. And I see 
that in what you’re trying to do. 

I just think we need to leave here with this understanding, that 
there’s more to this story than we know. If a foreign hacker got 
into this, I can assure you that they know what was in those 
emails that were deleted. They read them all. They know what is 
in the emails that we never received. 

Mr. Chairman, I yield back. 

Chairman Chaffetz. I thank the gentleman. We’ll now go to the 
gentleman from Wisconsin, Mr. Grothman, for 5 minutes. 

Mr. Grothman. Thank you. Thanks for coming on over to the 
Rayburn Building. As I understand it, your testimony today, is that 
you have not brought criminal charges against Hillary Clinton, in 
part, because you feel you can’t prove guilt beyond a reasonable 
doubt, and in part, because she didn’t understand the laws with re- 
gard to emails and servers and that sort of thing. 

Question for you. When she erased these emails — or no, I digress 
for a second. You, however, did say that if somebody did this under 
you there would be consequences. If somebody did exactly what 
Mrs. Clinton did, but was one of your lieutenants or you think one 
of the lieutenants under the CIA or some other agency that deals 
with top secret documents, what would you do to those underlings? 

Mr. CoMEY. I would make sure that they were adjudicated 
through a security disciplinary proceeding to figure out what are 
all the circumstances and then what punishment, discipline is ap- 
propriate. That could range from being terminated, to being rep- 
rimanded, and then a whole spectrum in between, suspension, loss 
of clearance. It’s a bunch of different options. 

Mr. Grothman. Okay. But tomorrow, say one of your top two or 
three lieutenants you find out that they’ve had this separate server 
out there and they’re keeping secret documents, you know, flipping 
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them around. Do you think they should be fired? Not criminally 
charged, but fired? 

Mr. COMEY. Yeah. I don’t think it’s appropriate to say. I think 
it should go — we have a very robust process. There ought to be a 
very intense suitability review of that person. Maybe there’s some- 
thing we’re missing that would mitigate the punishment we would 
impose. But it would have to do through our system. 

Mr. Grothman. Okay. Next question. Just for the listening audi- 
ence here, at first when I hear about erasing emails, I think it’s 
like, you know, on my own phone where I might erase an auto in- 
surance solicitation. The erasures here, however, were not just 
Mrs. Clinton pressing delete. Were they? There was a much greater 
effort made to make sure that these emails would never be recov- 
ered. Do you want to comment on what was done to erase the 
emails? 

Mr. CoMEY. I think what you’re referring to is after her law- 
yers — her lawyers say, although I’m not able to verify this, there 
were 60,000 or so left at the end of 2014. They went through them 
in a way I described in my statement 2 days ago. And then they 
produced the ones that were work-related, and then they erased 
from their system the ones that were not work-related. That was 
done using technical tools basically to remove them from the serv- 
ers to wipe them way. 

Mr. Grothman. Okay. So in other words, the effort was not just 
Mrs. Clinton or somebody went delete, delete, delete. They went 
above and beyond that so that your top technical efforts could not — 
technical experts could not get back at these emails, correct? 

Mr. CoMEY. Right. Not fully. We were able to by going 

Mr. Grothman. You recovered a few. 

Mr. CoMEY. Yeah. We could go through the lawyers’ laptops and 
see some traces, but not fully — not fully recover them. 

Mr. Grothman. Okay. Now, the information that I have, and you 
can correct me if I’m wrong, implies that these erasures were done 
in December of 2014 after the Benghazi scandal broke, after there 
were questions about the Clinton Foundation. Did you ever come 
across why she allowed these emails to sit out there, even for years 
after she stopped being Secretary of State but all of a sudden as 
these other scandals began to bubble up she felt, or her lawyers 
felt, that she had to erase them? 

Mr. CoMEY. Yeah. I think the way the process worked is she had 
emails that were just on her system. She actually had deleted 
some, I think, over time, as an ordinary user would. And then the 
State Department contacted her and other former Secretaries and 
said. We have a gap in our records. We need you to look and see 
if you have emails and give them back. She then tasked her law- 
yers to engage in this review process of that 60-some thousand and 
make that cut. And then was asked by her lawyers at the end. Do 
you want us to keep the personal emails? And she said, I have no 
use for them anymore. It’s then that they issued the direction that 
the technical people delete them. 

Mr. Grothman. Do you think Mrs. Clinton knew that the tech- 
nical people were erasing these emails so that even your top tech- 
nical experts could recover them? 
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Mr. COMEY. Based on my sense now of her technical sophistica- 
tion, I don’t think so. 

Mr. Grothman. You don’t think the lawyers told her that that’s 
what they were doing, erasing all these emails that everybody on 
this committee wanted to look at? 

Mr. CoMEY. Yeah. And I’m sure we’ve asked this and 

Mr. Grothman. What type of lawyer wouldn’t tell their client 
they were doing that? But 

Mr. COMEY. I don’t think — I think our evidence — our investiga- 
tion is they did not, that they asked her. Do you want to keep 
them, and they said no, and they said. Wipe them away. 

Mr. Grothman. Okay. Now, as I understand it, the goal was just 
to erase personal emails, but you’ve recovered emails that wouldn’t 
be considered personal emails at all. 

Mr. CoMEY. Correct. 

Mr. Grothman. Okay. I know that you didn’t recover them, but 
based upon the emails that you recovered, presumably her lawyers 
or somebody was going well beyond personal emails, is it possible 
we’ll never be able to recover emails that dealt with the Clinton 
Foundation or dealt with the Benghazi scandal? Is it possible, be- 
cause of what her lawyers did, that they were erasing things that 
were incriminating, maybe involving items that you yourself were 
not particularly investigating, but that these have now been de- 
stroyed forever? 

Mr. CoMEY. I guess it’s possible. As I said in my statement on 
Tuesday, we did not find evidence to indicate that they did the era- 
sure to conceal things of any sort. But it’s possible, as I said on 
Tuesday, that there are work-related emails that were in the batch 
that were deleted. 

Mr. Grothman. I’m sorry. When you go to this length to make 
sure you can never recover the emails that are erased, wouldn’t you 
think the intent is to make sure nobody ever looks at them again? 
Why would — otherwise, would you just go 

Chairman Chaffetz. I thank the gentleman. We’ll give the Di- 
rector time if he wants to respond. 

Mr. CoMEY. Sure. You know, I guess it’s a bit circular. You delete 
because you want to delete, but that — what I mean is we didn’t 
find any evidence of evil intent, an intent to obstruct justice there. 

Mr. Grothman. You wouldn’t have been able to 

Chairman Chaffetz. I thank 

Mr. Grothman. — ^because you don’t know what was deleted, 
but 

Chairman Chaffetz. I thank the gentleman. 

We’ll now recognize Mr. Russell of Oklahoma for 5 minutes. 

Mr. Russell. Thank you, Mr. Chairman. 

Director Comey, thank you for your long service and your long 
suffering. I think we’re toward the end of the line here. 

I want to state for the record with regard to national security, 
I sleep a little easier at night knowing that you’re at the helm of 
the FBI. Thank you for your dedicated service and your integrity. 

Mr. Comey. Thank you. 

Mr. Russell. You have stated in your statement and also mul- 
tiple times here that there should be consequences for the mis- 
handling of state secrets. If I held a top secret/SCI in the Bureau — 
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and I did hold one when I was in the United States Army, in a ca- 
reer of service, I’ve handled classified information here — but if I 
held that in the FBI and you discovered that I mishandled state 
secrets on a private server in my basement, would I be trusted by 
the Bureau to further handle top secret/SCI information? 

Mr. COMEY. Maybe not. You would go immediately through a se- 
curity process to review whether you should continue working for 
us, and if you do, what clearances you should retain. 

Mr. Russell. If I violated the handling of state secrets in the 
FBI, would you consider me the best suitable candidate for pro- 
motion and higher responsibility? 

Mr. CoMEY. It would be a serious concern, and we would stare 
at it very hard in a suitability review. 

Mr. Russell. Although you have recommended to the Depart- 
ment of Justice that no criminal charges be brought to bear, are 
you recommending to the Department of Justice that there be no 
consequences for the mishandling of state secrets? 

Mr. COMEY. No. My recommendation was solely with respect to 
criminal charges. 

Mr. Russell. What would you recommend? 

Mr. COMEY. I don’t think it’s for me to recommend. 

Mr. Russell. But you do — ^you’ve been very open and even stated 
why you felt that these were unique sets of circumstances that 
called for greater transparency. You do make recommendations 
routinely, as you’ve stated here today. We’re talking top secret/SCI 
information that’s been mishandled. You would take a dim view to 
that if I were an agent. What consequence — this is what the Amer- 
ican people feel exasperated about. There seems to be no con- 
sequence. 

So in a case like this, if it’s not going to be criminal charges rec- 
ommended, what are the American people to do to hold their offi- 
cials accountable if maybe they shouldn’t be trusted for further pro- 
motion and higher responsibility? 

Mr. CoMEY. And what I meant earlier is that’s not a question 
that the American people should put to the FBI Director. I can an- 
swer about the things within my remit, but that — I understand the 
question, but it’s not one for me to answer in my role. 

Mr. Russell. Well, I hope it’s one that the American people an- 
swer in the future, because we do have a choice about those that 
would mishandle information. And while we’re all fallible human 
beings and we all make mistakes, in a case like this, I mean, for 
decades of my service in the Army infantry and handling top se- 
cret/SCI information and then as a Member of Congress, I mean, 
we know those responsibilities. 

Is it your view and others that have interviewed Mrs. Clinton 
that she would not have known what those responsibilities were? 

Mr. COMEY. No, I think, in a way, you would expect she under- 
stood the importance of protecting classified information. 

Mr. Russell. Well, I would agree with that. And there has been 
a breach, and I think that the American people demand a con- 
sequence, that they demand an accountability. And I think it’s im- 
portant, to uphold the form of our republican government, that we 
have a consequence. 

And with that, thank you for your appearance here today. 
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And I would like to yield the remainder of my time to Chairman 
Chaffetz. 

Chairman Chaffetz. Thank you. I think, if you yield back, 
through mutual agreement, Mr. Cummings and I have agreed that 
I do have about a dozen or so quick follow-up questions. You’ve 
been most generous with your time, but I would like to get through 
these last bit. 

Mr. COMEY. Okay. 

Chairman Chaffetz. And, again, we’ll do so with equal time. 

How did the Department of Justice — or how did the FBI view the 
incident in which Hillary Clinton instructed Jake Sullivan to take 
the markings off of a document that was to be sent to her? 

Mr. CoMEY. Yeah. We looked at that pretty closely. There was 
some problem with their secure fax machine. And there’s an email 
in which she says, in substance, take the headers off of it and send 
it as a nonpaper. 

As we’ve dug into that more deeply, we’ve come to learn that, at 
least there’s one view of it that is reasonable, that a nonpaper in 
State Department parlance means a document that contains things 
we could pass to another government. So essentially, take out any- 
thing that’s classified and send it to me. 

Now, it turned out that didn’t happen, because we actually found 
that the classified fax was then sent, but that’s our best under- 
standing of what that was about. 

Chairman Chaffetz. So this was a classified fax? 

Mr. CoMEY. Correct. 

Chairman Chaffetz. So Hillary Clinton sends to Jake Sullivan — 
let me go back. Jake Sullivan says: They say they had issues send- 
ing secure fax. They’re working on it. Hillary Clinton sends to Jake 
Sullivan: If they can’t, turn into nonpaper with no identifying head- 
ing and send nonsecure. 

Mr. CoMEY. Yeah. 

Chairman Chaffetz. So you’re telling me it’s a classified piece 
of information, she’s taking off the header, and she’s instructing 
them to send it in a nonsecure format. 

Mr. COMEY. Right. 

Chairman Chaffetz. Is that not intent? 

Mr. Comey. Well, that actually caught my attention when I first 
saw it. And what she explained to us in her interview was, and 
other witnesses did as well, is what she meant by that is make it 
into a nonclassified document, that’s a what a nonpaper is in their 
world, and send it to us, because I just — I don’t need the classified 
stuff, I just need the 

Chairman Chaffetz. Then why take off the heading? If it’s going 
to be turned into a nonclassified document, why take off the head- 
ing? 

Mr. Comey. I assume because it would be nonclassified anymore, 
so you wouldn’t have a classified header on it, I think is what she 
said during her interview. 

Chairman Chaffetz. So she wanted to be technically correct? Is 
that what you’re saying? This is your 

Mr. Comey. No. I think what she said during the interview is: 
I was telling him, in essence, send me an unclassified document, 
take the header off, turn it into a nonpaper. Which is a term I’d 
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never heard before, but I’m told by people I credit that in diplo- 
matic circles, that means something we could pass to another gov- 
ernment. 

Chairman Chaffetz. You are very generous in your accepting of 
that. 

Let me ask you. Director, did any uncleared individuals receive 
any classified information over Hillary Clinton’s server? 

Mr. CoMEY. Did any uncleared people receive classified informa- 
tion? I don’t think any of the correspondents on the classified 
emails were uncleared people. These were all people with clear- 
ances working, doing State Department business on the unclass 
system. 

Chairman Chaffetz. Did Mr. Pagliano have the requisite secu- 
rity clearance? 

Mr. CoMEY. As I sit here today, I can’t remember. He was not 
a participant on the classified email exchanges, though. 

Chairman Chaffetz. He was running the server. He set up the 
server. 

Mr. COMEY. That’s a different question. Well, I’m sorry. I mis- 
understood your question, then. 

Yeah. There’s no doubt that uncleared people had access to the 
server, because even after Pagliano, there were others who main- 
tained the server who were private sector folks. 

Chairman Chaffetz. So there are hundreds of classified docu- 
ments on these servers. How many people without a security clear- 
ance had access to that server? 

Mr. CoMEY. I don’t know the exact number as I sit here. It’s 
probably more than 2, less than 10. 

Chairman Chaffetz. And I appreciate your willingness to follow 
up with this. 

Did Secretary Clinton’s attorneys have the security clearances 
needed? 

Mr. CoMEY. They did not. 

Chairman Chaffetz. Does that concern you? 

Mr. COMEY. Oh, yeah. Sure. 

Chairman Chaffetz. Is there any consequence to an attorney ri- 
fling through Secretary Clinton’s, Hillary Clinton’s emails without 
a security clearance? 

Mr. COMEY. Well, not necessarily criminal consequences, but 
there’s a great deal of concern about an uncleared person, not sub- 
ject to the requirements we talked about in the read-in documents, 
potentially having access. That’s why it’s very, very important for 
us to recover everything we can back from attorneys. 

Chairman Chaffetz. So what’s the consequence? I mean, here 
Hillary Clinton gave direction to her attorneys without a security 
clearance to go through documents that were classified. 

Mr. Comey. I think that’s what happened in fact. Whether that 
was the direction is a question I can’t answer sitting here. 

Chairman Chaffetz. You’re parsing that one a little bit for me. 

Mr. Comey. No, no. You were just asking me. I don’t — I don’t 
know 

Chairman Chaffetz. What’s the consequence? They don’t work 
for the government. We can’t fire them. 

Mr. Comey. Right. 
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Chairman Chaffetz. So is there no criminal prosecution of those 
attorneys? Should they lose their bar license? What’s the con- 
sequence to them? 

Mr. COMEY. Well, if they acted with criminal intent or acted with 
some mal-intent. 

Chairman Chaffetz. What you’re telling us is it doesn’t matter 
if you have a security clearance or not, because I may be innocent 
enough, hey. I’m just an attorney, I like the Secretary, I’m trying 
to help Hillary Clinton, I’m not trying to give it to the Chinese or 
the Russians, I’m just trying to help her. So there’s no intent? It 
doesn’t matter if these people have security clearances? 

Mr. CoMEY. Of course it matters. That’s why I said 

Chairman Chaefetz. But there’s no consequence. Director. 
There’s no consequence. 

Mr. COMEY. Well, I don’t know what consequence you’d have in 
mind. Very 

Chairman Chaffetz. Prosecute them. 

Mr. COMEY. An attorney for receiving from his client information 
that ends up being classified? 

Chairman Chaffetz. I asked you at the very beginning, does 
Hillary Clinton — is there a reasonable expectation that Hillary 
Clinton would send and receive hourly, if not daily, classified infor- 
mation? That’s reasonable to think that the Secretary of State 
would get classified information at every moment. She is not the 
head of Fish and Wildlife. 

So the idea that she would turn over her emails, her system, her 
server to, what it sounds like, up to 10 people without security 
clearances, and there’s no consequence. So why not do it again? 

Mr. COMEY. Well, that’s a question I don’t think you should put 
to me. You’re asking — I’m talking about my criminal investigation. 

Chairman Chaffetz. But how can that — there’s no intent there? 
Does she not understand that these people don’t have security 
clearances? 

Mr. CoMEY. Surely she understands at least some of them don’t 
have security clearances. 

Chairman Chaffetz. So she understands they don’t have secu- 
rity clearances and it’s reasonable to think she’s going to be getting 
classified information. Is that not intent, to provide a noncleared 
person access to classified information? 

Mr. COMEY. You’re mixing it up, though. I don’t think it’s reason- 
able to assume — mixing me up, sorry, it’s not your fault — that 
someone who is maintaining your server is reading your emails. In 
fact, I don’t think that’s the case here. 

There’s a separate thing, which is when she’s engaging counsel 
to comply with the State Department’s requests, are her lawyers 
then exposed to information that may be on there that’s classified. 

Chairman Chaffetz. Did they see any classified information? 
Did Hillary Clinton’s attorneys, without security clearances, see 
classified information? 

Mr. CoMEY. As I sit here, I don’t know the answer to that. 

Chairman Chaffetz. It has to be yes. Director. You came across 
110, and they said they went through all of them. 

Mr. CoMEY. Well, they didn’t read them all, they just looked at 
headers. 
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Chairman Chaffetz. So their excuse is, “We saw the emails, but 
we didn’t read them”? 

Mr. COMEY. No, I think I said this in my statement on Tuesday, 
they sorted the emails by using headers and search terms to try 
and find work-related emails. We read them all. 

Chairman Chaffetz. I know that you read them all. Do you 
think it’s reasonable or unreasonable to think that her attorneys, 
under her direction, did or did not read those emails? Because 
there were — let me go back to this. Yes or no, were there or were 
there not classified emails that her, that Hillary Clinton’s attorneys 
read? 

Mr. Comey. I don’t know whether they read them at the time. 

Chairman Chaffetz. Did Hillary Clinton give noncleared people 
access to classified information? 

Mr. Comey. Yes. Yes. 

Chairman Chaffetz. What do you think her intent was? 

Mr. Comey. I think then it was to get good legal representation 
and to make the production to the State Department. I think it 
would be a very tall order in that circumstance, I don’t see the evi- 
dence there to make a case that she was acting with criminal in- 
tent in her engagement with her lawyers. 

Chairman Chaffetz. And I guess I read criminal intent as the 
idea that you allow somebody without a security clearance access 
to classified information. Everybody knows that. Director. Every- 
body knows that. 

I’ve gone way past my time. Let me recognize Mr. Cummings for 
an equal amount of time. 

Mr. Cummings. Director, thank you for your patience. 

I want to clear up some things. I want to make sure I under- 
stand exactly what you testified to on the issue of whether Sec- 
retary Clinton sent or received emails that were marked as classi- 
fied. 

On Tuesday, you stated, and I quote: “Only a very small number 
of the emails containing classified information bore markings” — 
and I emphasize, bore markings — “indicating the presence of classi- 
fied information,” end of quote. Republicans have pounced on this 
statement as evidence that Secretary Clinton lied. But today we 
learned some significant new facts, and I hope the press listens to 
this. 

First, you clarified that you were talking about only 3 emails out 
of 30,000 your office reviewed. Is that right? 

Mr. Comey. Three, yes. 

Mr. Cummings. Three out of 30,000. Is that right? 

Mr. Comey. Yes. At least 30,000. 

Mr. Cummings. At least 30,000. 

Second, you confirmed that these three emails were not properly 
marked as classified at the time based on Federal guidelines and 
manuals, they did not have a classification header, they did not list 
the original classifier, the agency, office of origin, reason for classi- 
fication, or date for declassification. Instead, these emails included 
only a single, quote, “C,” parenthesis, end parenthesis, and then 
end of quotation mark, for confidential on one paragraph lower 
down in the text. Is that right? 

Mr. Comey. Correct. 
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Mr. Cummings. Third, you testified that based on these facts, it 
would have been a, quote, “reasonable inference” for Secretary 
Clinton to, quote, “immediately,” end of quote, conclude that these 
emails were not, in fact, classified. So that was also critical new in- 
formation. 

But there’s one more critical fact, that these emails were not in 
fact — and that is this. Director, and to the press — these emails 
were not, in fact, classified. The State Department explained to us 
yesterday, they reported that these emails are not classified and 
that including the little C on these emails was a result of a human 
error. The bottom line is that those little C’s should not have been 
on those documents because they were not in fact classified. 

When Representative Watson Coleman asked you a few minutes 
ago about this, you testified that you had not been informed. And 
I understand that. I’m not beating up on you, I promise you. But 
can you tell us why. Director Comey, because I want — ^you know, 
because the Republicans are pouncing and saying that the Sec- 
retary lied, and so I want to make sure that we’re clear on this. 

Can you tell us why. Director Comey, did you consult — and we’re 
just curious — did you consult with the State Department about 
these 3 emails out of the more than 30,000, or did this just not 
come up? What happened there? 

Mr. Comey. Yeah. I’m not remembering for sure while I’m here. 
I’m highly confident we consulted with them and got their view on 
it. I don’t know about what happened yesterday, maybe that their 
view has changed or they found things out that we didn’t know. 
But I’m highly confident we consulted with them about it. 

Mr. Cummings. So this is totally different than what we under- 
stood yesterday. Today we learned that these emails were not in 
fact classified. They should not have been included — they should 
have not included those stray markings, they were not properly 
marked as classified, and the Director of the FBI believes it was 
reasonable for Secretary Clinton to assume that these documents 
were not classified. 

Chairman, you raised a question about whether Secretary Clin- 
ton’s attorneys had security clearances. It’s my understanding that 
they did. We can double-check that, but that is my understanding. 
We’ll double-check that. 

Going on, let me move to the next topic. You explained on Tues- 
day that you were providing, quote, “an update on the FBI’s inves- 
tigation of Secretary Clinton’s use of a personal email system dur- 
ing her time as Secretary of State.” You explained that you re- 
ceived a referral on this matter from the inspector general of the 
intelligence community on July 6, 2016. Is that right. 

Mr. Comey. Yes. 

Mr. Cummings. Today, tens of thousands of Secretary Clinton’s 
emails are publicly available on the State Department’s Web site. 
And our staff have been reviewing the emails that were retro- 
actively determined to include classified information. 

Based on this review, it appears that these emails included more 
than 1,000 individuals who sent or received the information that 
is now redacted as classified. Let me make that clear. About 1,000 
people sent or received the same information that was contained in 
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Secretary Clinton’s emails and retroactively classified. Were you 
aware of that? 

Mr. COMEY. No. The number doesn’t surprise me, though. 

Mr. Cummings. Why not? 

Mr. CoMEY. Because this was — they were doing the business of 
the State Department on this email system. So I don’t know how 
many thousands of people work at the State Department, but it 
doesn’t surprise me there would be lots of people on these chains. 

Mr. Cummings. And would you agree that we need — that some- 
thing needs to be done with regard to this classification stuff, be- 
cause things are classified, then they’re not classified, then they 
are retroactively classified. I mean, does that go into your consider- 
ation when looking at a case like this? 

Mr. CoMEY. Yeah. I don’t pay much attention to the up-classified 
stuff, because we’re focused on intent. So if someone classifies it 
later, it’s impossible that you formed intent around that, because 
it wasn’t classified at the time. I know that’s a process. I wasn’t 
familiar with it before this investigation, but I don’t spend a lot of 
time focused on it in the course of a criminal investigation. 

Mr. Cummings. I understand. We also reviewed who these people 
are, and they include a host of very experienced career diplomats 
with many years of experience. So let me ask you this. When you 
received this referral from the inspector general about Secretary 
Clinton’s emails, did you also receive any referrals for any of the 
other 1,000 people who sent and received those emails? Did you? 

Mr. CoMEY. No. 

Mr. Cummings. I understand 

Mr. CoMEY. Well, I should stop there. Within the scope of our in- 
vestigation was a group of people closer to the Secretary. We looked 
at their conduct. I forget what the number is, four or five of them. 
But then the hundreds of others who may have been on the chains 
were not the subjects of the investigation. 

Mr. Cummings. Okay. I think I have 30 more seconds. 

I understand that Secretary Clinton is the only one running for 
President, but it does not make sense that she was singled out for 
a referral to the FBI. Do you agree with that? 

Mr. COMEY. No, I don’t — I don’t think I agree with that. 

Mr. Cummings. Okay. So you — so you — let’s go back to Colin 
Powell. Do you think you ought to look at his situation? Or 
Condoleezza Rice? 

Mr. COMEY. Well, there’s been no referral on them. I know only 
sort of at a superficial level their circumstances. This case strikes 
me as very different from those and not an inappropriate referral 
from the inspector general. 

Mr. Cummings. Very well. 

Chairman Chaffetz. I thank the gentleman. 

Who was Hillary Clinton emailing that was hacked? 

Mr. CoMEY. Yeah. I don’t want to say in an open forum. We can 
get you that information, but I don’t want to — again, I don’t want 
to give any hostile adversaries insight into who — what we figured 
out. 

Chairman Chaffetz. Fair enough. 

Mr. CoMEY. So I know the names. 

Chairman Chaffetz. Understood. 



88 


Mr. COMEY. Yeah. 

Chairman Chaffetz. Was there any evidence of Hillary Clinton 
attempting to avoid compliance with the Freedom of Information 
Act? 

Mr. Comfy. That was not the subject of our criminal investiga- 
tion, so I can’t answer that sitting here. 

Chairman Chaffetz. It’s a violation of law, is it not? 

Mr. Comfy. Yes. My understanding is there are civil statutes 
that apply to that. I don’t know of 

Chairman Chaffetz. Let’s put the boundaries on this a little bit, 
what you didn’t look at. You didn’t look at whether or not there 
was an intention or the reality of noncompliance with the Freedom 
of Information Act? 

Mr. Comfy. Correct. 

Chairman Chaffetz. You did not look at testimony that Hillary 
Clinton gave in the United States Congress, both the House and 
the Senate? 

Mr. Comfy. To see whether it was perjurious in some respect? 

Chairman Chaffetz. Yes. 

Mr. Comfy. No, we did not. 

Chairman Chaffetz. Did you review and look at those tran- 
scripts as to the intent of your recommendation? 

Mr. Comfy. I’m sure my folks did. I did not. 

Chairman Chaffetz. So — okay. And this is an important point, 
because I think those of us in Congress, knowing that you got a 
criminal referral from an inspector general, thought that you were 
also looking at whether or not Hillary Clinton had provided false 
testimony, which is a crime, to the Congress, but you didn’t look 
at that. 

Mr. Comfy. Correct. As I said. I’m confident my folks looked at 
the substance of the statements trying to understand the cir- 
cumstances around the entire situation. 

Chairman Chaffetz. Can you confirm that? I just want to 
make 

Mr. Comfy. Yeah, we’ll confirm that. And also, again, maybe I’m 
missing this, but I don’t think we got a referral from congressional 
committees, a perjury referral. 

Chairman Chaffetz. No. It was the inspector general that initi- 
ated this. 

Mr. Comfy. Yeah. 

Chairman Chaffetz. Did the — the fact that Hillary Clinton re- 
fused to be interviewed by the inspector general, what did that say 
to you about intent? 

Mr. Comfy. Not, at least for our criminal investigation, not par- 
ticularly germane. 

Chairman Chaffetz. Are you familiar — ^you’re familiar — there’s 
a Web site. I mean, lots of government agencies have Web sites. 
The State Department has a Web site, state.gov, and they have a 
YouTube site. Videos that are uploaded to a YouTube site, would 
those be considered Federal records? 

Mr. Comfy. I don’t know. 

Chairman Chaffetz. So they’re paid for by Federal dollars, 
they’re maintained by Federal employees. Would that not be a Fed- 
eral record? 
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Mr. CoMEY. Yeah, I just don’t know. I’m sure there’s an expert 
who could answer that in 2 seconds, but I’m not that expert. 

Chairman Chaffetz. Okay. We’ve kept you here a long time. I 
want to follow up on that. 

Is the FBI still investigating Hillary Clinton’s aides? 

Mr. CoMEY. No is the answer. The Department of Justice de- 
clined on all of those who were subjects communicating with her 
through that email system. 

Chairman Chaffetz. What recommendations did you make 
about her aides? 

Mr. Comey. Same. Same. We didn’t recommend that anybody be 
prosecuted on those facts. 

Chairman Chaffetz. And if you can help us understand who 
precisely had been ruled out for prosecution, that would be 

Mr. Comey. Sure. 

Chairman Chaffetz. Did you look at the Clinton Foundation? 

Mr. Comey. I’m not going to comment on the existence or non- 
existence of any other investigations. 

Chairman Chaffetz. Was the Clinton Foundation tied into this 
investigation? 

Mr. Comey. I’m not going to answer that. 

Chairman Chaffetz. The server that was set up in her home 
was originally set up by, you said, former President Bill Clinton. 

Mr. Comey. Correct. 

Chairman Chaffetz. Do you know who paid for that? 

Mr. Comey. I don’t, sitting here. 

Chairman Chaffetz. Okay. I’ll allow some equal time now for 
my colleague and friend, Mr. Cummings. 

Mr. Cummings. I’m going to yield 2 minutes to — of my 3.43 — to 
Mr. Lynch. 

Mr. Lynch. Thank you, Mr. Director. We’re talking about hack- 
ing. And so on this committee we’re very much interested in cyber- 
security and we review a lot of the major hacks that are going on. 
So just recently, and I would say in the last 18 months, we’ve had 
a major hack, February of 2016, at the Department of Homeland 
Security and the FBI. We had a hacking group, the SITE Intel- 
ligence Group, reported that a group called Crackers With Attitude 
had hacked 9,000 employees’ data from the Department of Home- 
land Security, including names, email addresses, locations, tele- 
phone numbers; also 20,000 FBI workers. 

We had another hack — direct evidence, obviously, of those — an- 
other hack at 0PM of 4.2 million current and former Federal Gov- 
ernment employees. Their information had been stolen, including 
Social Security numbers, which were not redacted. 

We had IRS in May 2015, millions — no. I’m sorry, 200,000 at- 
tempted and 100,000 were successful. We had — the State Depart- 
ment announced a breach of its computer systems after an infiltra- 
tion forced the agency to temporarily shut down its classification 
system. We had the United States Postal Service, 800,000 postal 
employees, 2.9 million customers. 

The White House, The Washington Post reported back in — this 
is back in 2014 — that the White House computer was hacked. The 
National Oceanic and Atmospheric Administration. I’m on another 
committee for Financial Service. We had Verizon. UCLA Health 
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Systems, thousands and thousands and thousands of employees. 
Anthem HealthCare. Sony Pictures. Staples. Home Depot. 
JPMorgan. It gets into the millions. Community Health Systems. 
Target. TJX. 

So all these we have direct evidence, millions and millions and 
millions of people, their accounts being hacked. Any direct evidence 
that Hillary Clinton’s emails were hacked? 

Mr. COMEY. No. 

Mr. Lynch. Okay. I have no further questions. I yield back. 

Mr. Cummings. Mr. Director, we are about at the end. I’m going 
to do a concluding statement and then I think the chairman will. 

I want to, first of all, I want to go back to something that Mrs. 
Watson Coleman said a little earlier. As an African American man 
in this country, 66 years old, moving towards the twilight of my 
life, we cannot allow Black men to continue to be slaughtered. 

This morning I woke up to my wife literally crying watching the 
tape of this guy, Alton Sterling, in Baton Rouge. And then she 
looked at the one, Philando Castile, near Minneapolis. And I hope 
you watched them. There’s something wrong with this picture. 

And don’t get me wrong. I am all for. I’ve supported police, I am 
a lawyer, and I know how important police are, and I know there’s 
so many great folks. 

But, Mr. Director, if you do nothing else in your 2,000-plus days 
left, you have got to help us get ahold of this issue. It is so painful, 
I can’t even begin to tell you. 

And so I don’t want — I’ve been fortunate in my life. I’ve been 
very fortunate that I have not been harmed by the police. But I’ve 
been stopped 50 million times. 

Now, with regard to this hearing, I want to thank you again. You 
know, as I listened to you, you said something that I will never for- 
get, and for some reason it gave me a chill. You said there are two 
things that are most important to me, two things. You said: My 
family and my reputation. My family and my reputation. 

And I don’t know whether your family’s watching this, but I hope 
that they are as proud of you as I am, because you are the epitome 
of what a public servant is all about, sacrificing over and over and 
over again, trying to do the right thing, sometimes coming under 
ridicule, but yet still doing the right thing. And so I hope that they 
are proud of you. 

The second thing is that no matter what has happened in this 
hearing, I hope that you know that your reputation is still intact. 

And so I conclude by summarizing that I think some of our — of 
some of our key findings today. First, the Director testified that his 
entire team of 15 to 20 FBI investigators unanimously agreed on 
the recommendation not to prosecute Secretary Clinton. 

Second, Director Comey made crystal clear that Republican 
claims and some of the talking heads’ claims of bias are completely 
false. He testified that he would treat John Doe the same way he 
would treat Hillary Clinton, that he was very forceful on that 
point. 

Third, on the claim that Secretary Clinton sent or received 
emails that were marked as classified, that claim has now been sig- 
nificantly undercut. Those documents were not classified and those 
markings were not proper. 
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Finally, Republicans have repeatedly cried foul about a double 
standard when it conies to Secretary Clinton’s emails, but Director 
Comey testified that the real double standard would have been to 
prosecute her with this completely inadequate evidence. 

Again, Director, I thank you, but I thank somebody else. I 
thank — and having practiced law for many years and having dealt 
with the FBI on many cases, I want to thank the people who work 
with you. Because it’s not just — it’s not just — this is not just about 
you. 

Mr. Comey. No. 

Mr. Cummings. This is not just about Secretary Clinton. When 
we are addressing you, there are a whole cadre of people who give 
their blood, their sweat, and their tears to protect us as Americans. 
And I just want to thank them, because sometimes I think they are 
forgotten, unseen, unnoticed, unappreciated, and unapplauded. But 
today I applaud them and I thank you. 

Thank you very much, and I yield back. 

Chairman Chaffetz. And I thank the gentleman. 

And I concur with the idea that every FBI agent I have ever met 
has just been above reproach, and they make us proud. And they 
work hard, they put their lives on the line, they serve overseas, 
they serve domestically. Can’t thank them enough for what they 
do, and I hope that is part of the message that we carry back. 

I cannot thank you personally enough, you on a personal level, 
for your accessibility, your ability to get on the phone with me the 
same day that you make your announcement, and then in rapid 
fire when I said to you, “What day is best, we’re going to have to 
do this, so which day is best for you?” and you said Thursday, and 
here we are and doing it. I can’t thank you enough. 

I wish all of the government employees would have that attitude 
and approach, I really do, and I can’t thank you enough. I look for- 
ward to working with you and your staff as we move forward in 
getting this documentation, things that you can’t share publicly, 
and others. 

It is the intention of the committee to — I had told Mr. Cummings 
here that we would come back after votes. Votes have been pushed 
back now a bit. So what I’d like to do is to go into recess for 5 min- 
utes and then we will start with our second panel. 

The committee stands in recess till 5 minutes from now. 

Thank you again. Director Comey. 

[Recess.] 

Chairman Chaffetz. The Oversight and Government Reform 
Committee will reconvene and we will now recognize our second 
panel of witnesses. 

I’m pleased to welcome the Honorable Steve Linick, inspector 
general of the United States Department of State. 

Mr. Linick, it is our understanding that you are accompanied by 
Ms. Jennifer Costello, assistant inspector general for the Office of 
Evaluations and Special Projects, whose expertise may be needed 
during questioning. So we will also ask that she be sworn in during 
this time too. 

We also welcome the Honorable Charles McCullough, III, inspec- 
tor general of the intelligence community at the Office of the Direc- 
tor of National Intelligence. 
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We thank you for being here. We thank you for your patience. 
It has been a long afternoon. But you’ve done some exceptionally 
significant and important work, and we want to hear it and under- 
stand it and digest it and ask questions about it. 

So pursuant to committee rules, all witnesses are to be sworn be- 
fore they testify. And as I said, we will also swear in Ms. Costello. 
If you will please rise and raise your right hands. 

Do you solemnly swear or affirm that the testimony you are 
about to give will be the truth, the whole truth, and nothing but 
the truth? 

Thank you. 

Let the record reflect that all three of the witnesses did answer 
in the affirmative. 

Inspector General Linick and Inspector General McCullough, you 
are both welcome to make oral remarks. We’ll be very generous 
with the time. And your entire written statement and extraneous 
materials will be entered into the record as you so wish. 

But let’s now go to Mr. Linick and recognize him. 

STATEMENTS OF MR. STEVE LINICK, MS. JENNIFER 
COSTELLO, AND MR. I. CHARLES MCCULLOUGH, HI. 

Mr. Linick. Thank you. Chairman Chaffetz. I’m pleased to be 
here to testify about our report on records management and cyber- 
security at the Department of State. I have no opening statements, 
and therefore am prepared to answer any questions the committee 
has about the report and any other matters. 

Chairman Chaffetz. Thank you, Mr. Linick. 

Mr. McCullough, we’ll now recognize you for as much time as 
you’d like. 

Mr. McCullough. Thank you. Chairman Chaffetz. It’s 

Chairman Chaffetz. If you could both bring those microphones, 
and it’s a little uncomfortable, but bring them right up there. There 
we go. Thank you. 

Mr. McCullough. It’s a pleasure to be here, and I’m here — I 
don’t have an opening statement either, so in the interests of time. 
I’m here to answer your questions, and I’m very happy to be here 
for you. 

Chairman Chaffetz. Thank you. 

I’ll now recognize myself first. 

I need you to summarize your findings as to what is happening 
and not happening with classified information. And, Mr. 
McCullough, my understanding is a referral was given that kicked 
off this whole process. Why did you make that referral? What was 
it that you were seeing that you think warranted an investigation? 

Mr. McCullough. We were — Chairman, we were assisting — I 
had been asked to assist IG Linick in a review of classification 
issues and other issues at the State Department. He requested my 
office to help because of our expertise with classification matters. 
And during our assistance with his particular review he was doing, 
we reviewed 300 documents that had already been released in the 
FOIA process for former Secretary Clinton’s emails. 

We saw some classified material, one classified document that 
had been released that wasn’t properly redacted. My inspectors no- 
ticed a second document that was classified but was properly re- 
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dacted. So we knew that in this sample of 300 that had already 
been published, that there were classified documents in this set of 
emails. 

So also during our review, looking at essentially the internal con- 
trols of the email processing at the State Department, again, the 
role that we played was to look at the controls to determine wheth- 
er or not the controls were sufficient to spot intelligence community 
equities in classified information. 

So we had talked to some people there and were hearing from — 
we heard from senior management officials that there were — they 
had perused the documents, and they were under the impression, 
one in particular, that there was a good deal of classified informa- 
tion in these documents yet to be processed, these 30,000 docu- 
ments. 

They also commented to us that they didn’t feel as though they 
had the personnel there, that there was a deficiency with the per- 
sonnel in terms of having the appropriate number of people, appro- 
priately cleared people, people with the appropriate expertise to re- 
view these documents. 

So I was looking at that. So we have — we have documents that 
are already published, already processed through a FOIA. One was 
not properly redacted and it was classified. And I’m being told by 
the State Department information management people that they 
have concerns that there’s a good deal of classified information in 
this set of documents. 

And on top of that, I was advised by Mr. Linick’s office that this 
whole set of emails was present on a thumb drive in Secretary 
Clinton’s attorney’s office. We knew nothing about the clearances 
for counsel or for the law firm. And I was also advised that this 
set of documents previously resided on a private server, which at 
that point in time was with a private company. 

So as an IG, I was facing a situation where I had classified infor- 
mation, it appeared to me, outside the care, custody, and control 
of the U.S. Government. 

In the intelligence community what you do when that happens 
is you tell the security component of the agency who owns that in- 
formation. In this case, I told the agencies who owned the informa- 
tion, I also told the ODNFs security component, the NCSC, and I 
was advised to go directly to the FBI with a referral with respect 
to my referral to them. 

Chairman Chaffetz. So these emails, which are supposedly all 
of Hillary Clinton’s emails, they were sitting in a secure or non- 
secure facility at her attorney’s office? 

Mr. McCullough. I don’t know anything about the security of 
the facility at the attorney’s office. I think — I had heard at that 
point in time that there was a safe there, and I think that it was 
represented 

Chairman Chaffetz. But it’s not a cleared — not cleared by the 
United States Government? 

Mr. McCullough. Not to my knowledge. 

Chairman Chaffetz. Mr. Linick, what was your finding here? 

Mr. Linick. Well, we were not involved in any of the classifica- 
tion determinations. I mean, our role in this was to look at the 
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FOIA process. We were asked jointly to look at the FOIA process, 
whether improvements could be made. 

And we made a number of recommendations to the Department 
to make sure that classified information wasn’t inadvertently re- 
leased in the context of doing the review for FOIA. That was our 
role in this. 

Chairman Chaffetz. Hillary Clinton had this convenient email 
arrangement with herself. Have you ever seen anything like that? 
Were there people that expressed concerns about that? And what 
happened when these people expressed concerns? 

Mr. Linick. Well, as we reported in our evaluation report, we did 
interview a couple of individuals who were in the Office of the Sec- 
retary, the computer division, SES/IRM, who said that they ap- 
proached the then-director of that particular office and expressed 
concerns both about the server and about whether or not her 
emails were being properly preserved under the Federal Records 
Act. 

And that individual, the director of SES/IRM, informed those in- 
dividuals that it had been approved by Legal and not to mention 
it again. 

Chairman Chaffetz. What does that mean, “not mention it 
again”? How did you read that? 

Mr. Linick. You know, I can only report — I can only report what 
the witnesses told us. We were not able to interview the indi- 
vidual — 

Chairman Chaffetz. Why not? 

Mr. Linick. I’m sorry, I didn’t hear the question. 

Chairman Chaffetz. Why not? Why didn’t you interview him? 

Mr. Linick. Well, we asked to interview him, but he declined to 
interview with us. So we were not able to get the benefit of his per- 
spective on it. So I’m really unable to interpret what that means, 
other than just present the facts. 

Chairman Chaffetz. And were you able to interview Hillary 
Clinton? 

Mr. Linick. We were not. 

Chairman Chaffetz. Why not? 

Mr. Linick. Well, we asked to interview Secretary Clinton. We 
interviewed all of the Secretaries. We looked at five Secretaries of 
State, going back to Madeleine Albright. And, through counsel, she 
declined to meet with us. 

Chairman Chaffetz. Did she indicate a reason why she would 
refuse to meet with the inspector general? 

Mr. Linick. Her counsel informed our staff that she had — that 
all of the information about the email was on the FAQ sheet pub- 
lished by her campaign. 

Chairman Chaffetz. So they directed you to the campaign? 

Mr. Linick. To the FAQ sheet. 

Chairman Chaffetz. At the campaign? 

Mr. Linick. On the Web site, yes. 

Chairman Chaffetz. The campaign Web site? 

Mr. Linick. I will have to check that. I’m not sure exactly what 
Web site it was. 

Chairman Chaffetz. Well, it’s an important point, so please 
check that. 
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Mr. Linick. Okay. 

Chairman Chaffetz. I have gone over my time. 

Let me recognize the gentleman from Massachusetts for 7 min- 
utes in equal time, Mr. Lynch. 

Mr. Lynch. Thank you, Mr. Chairman. 

The chairman asked — I want to follow up on that question. The 
chairman asked, have you ever seen anything like this before? And 
I think, in the fullness of your response, I would say you have. 

As you indicated, you investigated, you reviewed the records of 
five Secretaries of State. And here is part of your report. It says 
here that your report identified more than 90 department employ- 
ees under Secretary Powell and Secretary Rice who used personal 
email accounts for official business. 

And I will quote your report. The report says exactly this. It 
says, “OIG reviewed the Department email accounts of senior de- 
partment employees who served on the immediate staffs of Sec- 
retary Powell and Secretary Rice between 2001 and 2008. Within 
these accounts, OIG identified more than 90 department employees 
who periodically used personal email accounts to conduct official 
business, though OIG could not quantity the frequency of this use.” 

So I know this is sort of the second part of this hearing, but that 
would have been good information to have at the first one. 

Also, Inspector General Linick, in May, you issued a report on 
the management of email records by the Secretaries of State, and 
your review found that Secretary Powell used a personal email ac- 
count for official business. 

As a matter of fact, in his book, he lays it out. I’m not going to 
repeat it again, but there’s an interesting section here where, you 
know, he’d get a little frustrated with the State Department sys- 
tem, and he installed a laptop computer on a private line and just 
started emailing folks. And, again. Secretary Powell has later ad- 
mitted to deleting all of his emails. 

So we got 55,000 emails from Hillary Clinton. How many did we 
get from Secretary Powell? 

Mr. Linick. I’m not aware of any from Secretary Powell. 

Mr. Lynch. That would be zero. 

Mr. Linick. I believe that’s the case. 

Mr. Lynch. Yeah. Okay. 

Mr. Linick. Yes, he did use an aol.com account to transmit 
email. 

Mr. Lynch. Now, this is the — now, get this. So Secretary Powell 
is testifying before the United Nations Security Council, telling 
them they got — that there are weapons of mass destruction and we 
need to go into Iraq. At that time, he is using a personal email sys- 
tem. And he has deleted everything that he had in that file, so we 
have nothing. And Hillary Clinton is getting investigated. 

You know, it just — let me ask you, have you followed up with 
that and tried to get any information from Secretary Powell? 

Mr. Linick. Well, we haven’t. The Department, though, has 
asked for information from Secretary Powell, and I don’t believe 
they have received it yet. But you will have to ask the Department 
about that. 

Mr. Lynch. When did they — do you have any knowledge of when 
they asked? 
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Mr. Linick. You know, I’d have to — it’s in our report, the exact 
date. I don’t have it off the top of my head. 

Mr. Lynch. I do. October 21 , 2015. 

Mr. Linick. Perfect. 

Mr. Lynch. The State Department sent Secretary Powell a letter 
requesting that he contact his email provider, AOL, to determine 
whether any of his emails could still he retrieved. Is that right? 

Mr. Linick. That’s right. 

Mr. Lynch. Okay. 

And, in your report, you note that, as of May 2016, the Depart- 
ment has not received a response from Secretary Powell or his rep- 
resentative. Is that still correct? 

Mr. Linick. To the hest of my knowledge, that’s correct. 

Mr. Lynch. Okay. So we got nothing there. What are we doing 
about that? 

Mr. Linick. I mean, it’s up to the Department to get that infor- 
mation pursuant to NARA regulations. They are on the hook to re- 
cover records that are lost from the State Department, and, 
through that letter, they’re trying to fulfill that obligation. 

Mr. Lynch. So there’s a huge gap. 

We got the goose egg from Condoleezza Rice too. She gave us 
nothing, in terms of emails. So we have 8 years of silence from the 
Secretaries of State. 

Mr. Linick. Well, the difference with — we don’t — Condoleezza 
Rice, we believe, wasn’t using email to conduct State Department 
business. 

Mr. Lynch. But her staff were. 

Mr. Linick. Yes. 

Mr. Lynch. She’s got a bunch of staffers 

Mr. Linick. Yes. 

Mr. Lynch. And she served in 2001. This was not 1901. So there 
were emails. She acts like there were no emails in 2001. There 
were. We just don’t have any, not from her. 

Mr. Linick. We did find that her staff 

Mr. Lynch. I just think there’s a double standard going on here. 
People have talked about a double standard all day. How come 
these folks gave us the goose egg? We got zero. We got silence for 
8 years from our Secretaries of State, and no one is going after 
them. They don’t get subpoenaed up here. I haven’t seen them at 
these hearings. 

Chairman Chaffetz. Will the gentleman yield? 

Mr. Lynch. The gentleman will yield, yeah, sure. 

Chairman Chaffetz. The inspector general was able to interview 
them and talked to them, and they did look at them. 

Mr. Lynch. And they got nothing. They got the — they got the, 
you know, “Talk to the hand.” That’s what they got. They got zero. 

Chairman Chaffetz. Would the gentleman yield? 

No, he said that she did not use email. 

Mr. Lynch. They just told — ^but they never subpoenaed or any- 
thing. 

Chairman Chaffetz. But if you ask Mr. Linick what happened 
with her aides. I’d like him to answer that question. 



97 


Mr. Linick. So we did talk to Secretaries Rice and Powell and 
all the other Secretaries. Secretary Rice told us that she didn’t use 
email 

Mr. Lynch. And you just take that at face value? 

Mr. Linick. Well, we actually tested that. We looked at archives. 
We didn’t find — I mean, we tried to corroborate that. We did not 
find any evidence that she used 

Mr. Lynch. What about her immediate staff? 

Mr. Linick. Well, we did conclude that her immediate staff used 
email to conduct official business. 

Mr. Lynch. Yeah. 

Mr. Linick. So, we did. 

Mr. Lynch. Okay. So, you know, that’s interesting. Do we have 
their emails? 

Mr. Linick. I’d have to check on that. I do know that we, in the 
course of our work, we bumped into a number of emails that — clas- 
sified emails that staff sent to personal accounts. And we did write 
up a memo describing that and providing that to the Department 
and asking the Department to take appropriate action and make 
sure any of the archives — you know, the archives didn’t have classi- 
fied email in them. 

So we did take — same thing with Secretary Powell when we 
found the two classified emails that were sent to him. 

Mr. Lynch. Okay. 

Mr. McCullough, what do you think about this? 

Mr. McCullough. With regard to? 

Mr. Lynch. The lack of response by Secretary Powell, 4 years, 
and then getting zero from Condoleezza Rice as well. 

Mr. McCullough. My office’s role here was extraordinarily nar- 
row. When we came in, IG Linick’s office was doing this review. It 
was limited to the past five Secretaries. We don’t have the re- 
sources. The tasking, I believe, from Congress 

Mr. Lynch. We just spent $7 million investigating Secretary 
Clinton. We don’t have the resources to, you know, to 

Mr. McCullough. I’m talking about my office. The tasking from 
Congress was to determine whether classified information — one of 
the taskings that I believe Steve received was to determine wheth- 
er classified information had traversed nongovernmental systems 
at the State Department. His office had scoped that down to the 
five past Secretaries. 

When I came in, we thought it was the easiest thing and, quite 
frankly, we thought it would be the fastest thing to do, since they 
already had 30,000 documents they were processing for a FOIA, to 
determine whether or not they had sufficient internal controls in 
place to spot, identify classified information, identify classified eq- 
uities. 

Mr. Lynch. Can we subpoena AOL and just say, you know, this 
was a private account that the Secretary of State during a very im- 
portant part of our country’s history — and we want those emails, 
go get them, rather than just waiting for — and, look, I have great 
admiration for Secretary Powell. I do. But, still, that’s information, 
in fairness, that we should have. 

Mr. McCullough. I’m trying to explain that our — my office’s 
role and my role in the review was narrowly tailored to determine 
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whether or not classified information — we didn’t have — my office 
doesn’t have the resources to determine, with the thousands of em- 
ployees at the State Department, who was trafficking in classified 
information on personal systems and who was not. 

He already had 30,000 documents right there that were going 
over that 

Mr. Lynch. You mean Secretary Clinton’s documents? 

Mr. McCullough. That’s correct — that were going through a 
FOIA process. So, from an IG perspective — and it was more effi- 
cient for us — we thought we would look at the processes being used 
by the FOIA managers at the State Department. And we made rec- 
ommendations to them that 

Mr. Lynch. Did you recommend that we go after Secretary Pow- 
ell? 

Mr. McCullough. No. The recommendations we made were — 
first of all, they asked us, can you please give us — these are the 
people who were actually doing the review. They felt as though 
they didn’t have sufficient expertise there to spot intelligence equi- 
ties. And so we recommended that they include intelligence people 
for this type of FOIA review, this particular FOIA review. 

We also recommended that they get on — they were doing this re- 
view on a Secret-level system, a SIPRNet-level system, and because 
we had been told by some of the State officials that they thought 
there was a good deal of classified information in the emails, we 
recommended that they perform this processing on a Top Secret/ 
SCI-level system, a JWICS-level system. 

Mr. Lynch. But that went all over — that went completely around 
Secretary Powell’s information, because he was giving us nothing. 
They had only Secretary Clinton’s stuff, so they — this review of five 
Secretaries of State was heavily focused on Secretary Clinton be- 
cause of the complete absence of any other information. 

Mr. McCullough. I would have to defer to IG Linick with re- 
spect to any of the other Secretaries in terms of the availability of 
emails on personal systems. 

Mr. Lynch. Okay. 

I’ll yield back. I’m way over time. Thank you, Mr. Chairman. 

Chairman Chaffetz. Thank you. 

I now recognize the gentleman from South Carolina, Mr. Gowdy, 
for 5 minutes. 

Mr. Gowdy. Thank you, Mr. Chairman. 

Inspector General Linick, did you desire to interview Secretary 
Clinton as part of your investigation? 

Mr. Linick. Yes, we did. 

Mr. Gowdy. And were you able to do so? 

Mr. Linick. No, we were not. 

Mr. Gowdy. And how was it communicated to you that you were 
not going to be able to do so? 

Mr. Linick. Through her counsel. David Kendall had sent a let- 
ter to one of the team leaders on the report. 

Mr. Gowdy. Is that letter available for Congress to inspect? 

Mr. Linick. You know. I’ll go back and check, but I’ll have to get 
back to you on that. I mean, it certainly exists. Whether if it’s legal 
to provide it to you, sure. 
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Mr. Gowdy. Well, let’s do this then. Let’s fast-forward and let’s 
assume that you were able to interview her. Why did you seek to 
interview her? And what questions, specifically, would you have 
asked? 

Mr. Linick. Well, we were — the focus of our report was not about 
classified information. The focus of our report was how the Depart- 
ment over the past 20 years addressed records preservation and cy- 
bersecurity. 

And, you know, we were looking at — we were looking at whether 
or not — there was a rule the Department issued in 2005 requiring 
that employees use departmental systems. She used a nondepart- 
mental system, her server, to conduct official government business. 
And we wanted to ask her questions about that — whether she had 
approval, who approved it, and so forth. 

We also — so we wanted to get her perspective on those issues, 
among others. 

Mr. Gowdy. So let me see if I have this right. The inspector gen- 
eral for the State Department wanted to interview a former Sec- 
retary of State. 

Mr. Linick. That’s correct. 

Mr. Gowdy. And that request was declined. 

Mr. Linick. Yes. 

Mr. Gowdy. Well, at first blush, it sounds like your question was 
a reasonable one. You want to make sure that the information is 
safeguarded and protected and archived consistent with law. So I 
wonder why you weren’t able to interview her. Were you given a 
reason? 

Mr. Linick. Just the reason that I articulated before. Other than 
that, I would be speculating. 

Mr. Gowdy. What other questions — and if you need to ask any 
of the wonderful folks with you — what other questions would you 
have sought to ask the former Secretary of State? 

Mr. Linick. Well, we also looked at records preservation. And the 
rules required a certain — that she print and file her emails and 
that she, you know, make sure that they’re part of the agency rec- 
ordkeeping system. We wanted — we would’ve asked her about that. 

We would’ve asked her about some of the attempts to hack her 
system, at least as expressed by her — some of her staff, which we 
have identified in our report. We probably would’ve asked her 
about that. 

So those are the kinds of things, her state of mind and so forth. 

Mr. Gowdy. I don’t think you were in the room for Director 
Comey’s testimony, and I don’t know whether or not you had access 
to it in the back. 

Are you familiar with his testimony that convenience was one of 
the intentions the former Secretary had in having this unusual 
email arrangement with herself? 

Mr. Linick. No, I don’t recall that. But I did watch parts of the 
testimony. 

Mr. Gowdy. All right. He did cite convenience as one of the fac- 
tors. 

Do you know when her emails were returned to the State De- 
partment? 
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Mr. Linick. They were returned 21 months after she left the De- 
partment. 

Mr. Gowdy. What was going on the second month after she left 
that made it inconvenient to return them then? 

Mr. Linick. I wouldn’t be able to comment on that. 

Mr. Gowdy. How about the fourth month? 

Mr. Linick. Again, I just don’t know. 

Mr. Gowdy. How about the 1-year anniversary? 

Mr. Linick. Same answer. 

Mr. Gowdy. Do you know what possibly could have inspired her 
to begin searching for those records? 

Mr. Linick. Well, she did receive a request from the Department 
to return records in accordance with their obligations under the 
Federal Records Act, and there are regulations. 

Mr. Gowdy. But that obligation didn’t manifest itself 21 months 
later. That obligation was present the day she left office. 

Mr. Linick. And one of our findings was, along with Secretary 
Powell, that both of them failed to surrender their records, their 
personal records containing government business when they left 
the Department, thus depriving the Department of having those 
records as part of the agency recordkeeping system. 

Mr. Gowdy. And I assume you probably would’ve asked former 
Secretary had you had an opportunity to do so why it took 21 
months to return public records. 

And just so there’s no — I mean, nobody likes Congress. I get that. 
We’re not sympathetic. But there are FOIA requests that would’ve 
been received by the State Department during that time period, 
right? 

Mr. Linick. Possibly. 

Mr. Gowdy. How would those FOIA requests have been re- 
sponded to and complied with if they didn’t even have the records? 

Mr. Linick. Well, sir, as we identified in our previous report on 
FOIA, it would’ve been difficult if the records are not part of the 
agency recordkeeping system to respond to FOIA. 

Mr. Gowdy. I’m out of time, but I know the chairman will give 
me one more question since he’s given a lot more than one more 
question to other folks. 

I want you to assume an absurd hypothetical, that the Secretary 
of State has exclusive use of personal email and that she is cor- 
responding with someone who also uses personal email. Are you 
with me? 

Mr. Linick. I’m with you. 

Mr. Gowdy. How in the world is the State Department ever 
going to capture that email? 

Mr. Linick. It would be — and this is something we addressed in 
our FOIA report. It would be — it would be difficult because 

Mr. Gowdy. It’d be a challenge, wouldn’t it? 

Mr. Linick. It would, because only records under the agency’s 
control are subject to FOIA. So, in other words, the Department 
wouldn’t be able to reach in, necessarily, to a private account. So 
it 

Mr. Gowdy. Well, you wouldn’t even know about it, would you? 
If it’s personal-to-personal, how would you know about it? 

Mr. Linick. You wouldn’t know about it. 
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Mr. Gowdy. All right. 

Well, I’m barely out of time. I thank the chairman. 

Chairman Chaffetz. I thank the gentleman. 

I will now recognize Mr. Cummings for 7 minutes. 

Mr. Cummings. Inspector General Linick and Inspector General 
McCullough, on March 9, 2016, seven committee ranking members 
of the United States Congress from the House and the Senate sent 
you a letter. I signed this letter, along with the ranking members 
of both the Senate and the House Intelligence Committees, the 
House Foreign Affairs Committee, the Senate Foreign Relations 
Committee, and the House Armed Services Committee, and the 
Senate Judiciary Committee. 

Are you both familiar with the letter? 

Mr. McCullough. Yes, sir. 

Mr. Cummings. Are you, Mr. Linick? 

Mr. Linick. Yes, I am. 

Mr. Cummings. The letter asked you 13 questions. To date, nei- 
ther of you has answered one single one of those questions. Why 
is that? 

Mr. McCullough. We have responded to the letter, and, in the 
response to the letter, that has led to several individual Member 
meetings, and we have offered Member meetings to all the Mem- 
bers who had concerns so that we could address them. And the 
Member meetings I have had directly addressed those questions. 
And so, again, I would re-extend that offer to you. Ranking Mem- 
ber Cummings. 

Mr. Cummings. Well, let me, let me, let me — on May 16, 2016, 
Mr. McCullough, you provided a response that was written in such 
a way that it was overclassified, at the Secret level. 

Was it really necessary to classify your response that way? And 
why did you write a response that could be publicly — why didn’t 
you just do one that could be publicly available? 

Mr. McCullough. It wasn’t overclassified. Ranking Member 
Cummings. There was a lot of concern by Members who did not 
have access to certain of the emails. And I wanted to make sure 
that anyone receiving and reading that letter would understand 
that, if I was coming to brief, I wouldn’t be able to brief on the one 
set of emails that are ORCON with one of the agencies. 

Mr. Cummings. All right. 

Now, Mr. Linick, you responded on May 25, 2016. You had a 
short letter too. 

Mr. Linick. I did. 

Mr. Cummings. Wow. Like Mr. McCullough’s letter, it failed to 
answer any of the specific questions from the ranking members. 

You both received followup letters, again posing the same 13 
questions. Neither of you responded to those letters. 

And so I guess your answer is the same. Did you all talk to each 
other about how you all were going to coordinate and not respond 
to Members of Congress, ranking members at that? 

Mr. Linick. Well, the underlying issue in those letters was accus- 
ing our office of bias. And I think we responded in our letter that 
we conduct ourselves with the highest integrity, and I could vouch 
for my staff. We are obviously focused on where the facts lead. 
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we’re independent, and we’ve worked very competently on our re- 
ports. 

And I think our recent report, the evaluation on records preser- 
vation and cybersecurity, speaks for itself. No one has contested or 
challenged our findings or recommendations. And, in fact, the State 
Department has accepted the findings and recommendations. 

And we explained that in the letter. We explained that we have 
had bipartisan contacts with the Congress. So 

Mr. Cummings. Well, let me ask you some questions, because I’m 
going to run out of time. 

Other than through official press statements, have you or anyone 
in your office, with the knowledge of the office, provided any infor- 
mation regarding the review of Secretary of State Clinton’s emails 
to the news media? 

Mr. Linick. Well, we, like every other IG office, have a press of- 
fice. And when we get press inquiries, we respond to them. We re- 
spond to them appropriately. We would never 

Mr. Cummings. So the answer is yes. 

Mr. Linick. — we would never release — well, of course, just like 
every other IG office. If someone asks about our findings or is mis- 
interpreting, you know, what we’re doing, we’ll respond to it. 

But we have never released any confidential information or have 
been inappropriate. 

Mr. Cummings. Okay. 

Have you or your offices given any information, written or oral, 
regarding the review to the Republican congressional Members or 
staff that your offices have not made available simultaneously to 
the Democratic congressional Members or staff? 

Mr. Linick. No. We are bipartisan, always. 

Mr. McCullough. We’ve been bipartisan, bicameral 

Mr. Linick. Absolutely. 

Mr. McCullough. — at every step with our congressional notifi- 
cations. 

I believe there was a blip on one occasion. It was unintentional, 
where one side — and I think there was a briefing where the Mem- 
bers or the staffers had requested the other side not be there. We 
briefed one side, and then offered the exact same briefing to the 
other. 

But, otherwise, we’ve made every attempt to be bipartisan and 
bicameral with all of our reporting and all of our briefings. We’ve 
done a number of briefings. 

Mr. Cummings. The letter says, and I quote — this is the same 
letter that we sent you. It says, “Last week, a potential whistle- 
blower in the office of the State Department inspector general pub- 
licly accused the office of having an anti-Clinton bias.” 

What are the policies and procedures for employees of your of- 
fices to report concerns regarding ongoing investigations, including 
concerns of bias within your offices? 

Mr. Linick? 

Mr. Linick. Well we’re — if there are any issues about conflicts of 
interest, we would — I mean, as a matter of — as a matter of course, 
we would take action if there was an issue. 

But let me just say that I’ve been — prior to my having become 
an IG for the last 6 years, I was a career prosecutor for 16 years. 
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And the principles of integrity and honesty are of utmost impor- 
tance to me and to my work. 

So, you know, these allegations are entirely unfounded. Our work 
speaks for itself. And we will follow the facts wherever they lead, 
and partisan politics has no bearing on what we’re doing. 

Mr. Cummings. Well, this committee has a reputation for going 
after people who interfere with whistleblowers. And that’s why I 
have to ask you. This was a whistleblower who 

Mr. Linick. An anonymous whistleblower. 

Mr. Cummings. Well, he publicly accused the office. 

Mr. Linick. It was anonymous. We have no idea who or what. 
But these are unfounded allegations. This was before our report 
was issued. I think our report speaks for itself. 

Mr. Cummings. Let me ask you this — did you have a response to 
that, Mr. McCullough? 

Mr. McCullough. I would echo 

Mr. Cummings. And do it briefly, because I’ve got one more ques- 
tion. 

Mr. McCullough. I would echo IG Linick’s response. 

Mr. Cummings. Tell me something. What happens when you all 
disagree on things that should be classified? 

One of the things that bothers me about this whole thing is this 
retroactive classification. I mean, people on this committee may 
have committed a crime — I’m just telling you — ^by releasing things 
that were made retroactively classified. I mean, how do we deal 
with that? What can we do to try to clear that up? 

And what happens when you all disagree with each other? 

Mr. McCullough. So in terms of when our departments or 
whether when we disagree as IGs? 

Mr. Cummings. Yeah, I mean — yeah, when you disagree as IGs. 
In other words — in other words, your departments — one of your de- 
partments says there is something that should be classified, the 
other one says it shouldn’t, didn’t deserve that kind of classifica- 
tion. I mean, what happens then? Is there an arbitrator or what- 
ever? Because this stuff leads to crimes, as you well know. 

Mr. Linick. Well, we don’t make classification determinations. 
We don’t 

Mr. Cummings. Well, what can we do to help with that? 

Mr. McCullough. So, as IGs, we don’t make classification deter- 
minations. 

Mr. Cummings. Right. 

Mr. McCullough. You’re talking about when a department dis- 
agrees with another department. 

Mr. Cummings. Yes. 

Mr. McCullough. That happened in this case. So you had the 
State Department — and I did hear Director Comey’s testimony with 
respect to this up-classification. And that was relative — despite my 
years in the Federal Government, that was a relatively new term 
to me. I think that is a fairly common occurrence, a fairly common 
occurrence in the State Department. 

What I can say is that the emails that we reported to Congress 
in the congressional notification, we focused on those. Those were 
not up-classified, sir. Those were classified when they were sent 
and when they were received. So we were focusing on those. 
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Now, if there’s — there is a disagreement, and I think what you’re 
getting to is there was this parallel reporting issue where I believe 
there was an email or two, the State Department thought that they 
had received it from a different source. What I can tell you there 
is the agency that we dealt with and facilitated the classification 
on that, that’s one of the agencies who completed declarations for 
us. And they disagreed with the supposition that the information 
came from a parallel source. They believe that that information — 
they are the information owner for that information. 

Some of it was very specific. I can’t get into why it was their in- 
formation in an open forum here. But some of the information was 
specific enough to tell where it would’ve come from. 

Mr. Cummings. Are you all going to answer the 13 questions? 

Mr. McCullough. I think we’ll get together — if you’re not satis- 
fied with where we are right now 

Mr. Cummings. No, I’m not satisfied. I’m not. 

Mr. McCullough. — we will come and brief you in person, if you 
like, or 

Mr. Cummings. Yes, I would. 

Mr. McCullough. — I will get together — yes, sir. 

Mr. Cummings. Thank you. I appreciate it. 

Mr. McCullough. Okay. 

Chairman Chaffetz. And just as we recognize Mr. Meadows, I 
think what the committee should look at, in a bipartisan way — if 
we do it right, we do it tog:ether and do it united and do it unani- 
mous if we can. I am very intrigued by what Senator Patrick Moy- 
nihan did about 20 years ago. Because, in a bipartisan way, they 
issued a report about classification. And it was done so — and, basi- 
cally, the synopsis was: Everything is overclassified, and if every- 
thing is classified, then nothing is classified. 

And I do agree and concur with the gentleman from Maryland 
here, my friend, that the consistency, the human error, the prob- 
lems that this creates, with the mass amount of data and informa- 
tion and the millions of people that have classified clearance, it 
does create a problem. And I think a bipartisan commission, some- 
thing similar to what Senator Moynihan spearheaded 20-plus — 20 
years ago or so, is something that we should look at. 

Mr. Cummings. That’s a good idea, Mr. Chairman. 

Chairman Chaffetz. I’d ask unanimous consent to enter into the 
record the two inspector general reports that are under discussion 
today. 

Without objection, so ordered. 

Chairman Chaffetz. We’ll now recognize the gentleman from 
North Carolina, Mr. Meadows. 

Mr. Meadows. Thank you, Mr. Chairman. 

Mr. Linick, let me come to you, and feel free to have Ms. Costello 
jump in if she can illuminate the answer better. 

On March of 2015, Secretary Clinton publicly said, and I quote, 
“I opted for convenience to use my personal email account, which 
was allowed by the State Department,” close quote. She went fur- 
ther to say, “The laws and regulations in effect when I was Sec- 
retary of State allowed me to use my email for work. That is undis- 
puted,” close quote. 

Are those accurate statements? 
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Mr. Linick. Well, I’m — I hesitate to comment on public state- 
ments, but I will say that our report shows that 

Mr. Meadows. Well, we’re in a public forum now, and, obviously, 
a lot’s been said about it. Are those accurate or not? 

Mr. Linick. Well, I can tell you our report said that she didn’t 
have approval from senior officials at the Department, and we don’t 
believe it was permitted, both under the rules and none of the offi- 
cials, the senior officials who were there at the time, gave her ap- 
proval or were even aware that she had a server, according to 
them. 

Mr. Meadows. So let me see if I can digest that long answer into 
a very short, concise statement. It is not an accurate statement. 

Mr. Linick. Again, she didn’t have approval. So 

Mr. Meadows. Okay. 

So, Ms. Costello, would she have required approval in order to 
be able to use a personal email, according to regulations? Would 
she have required that kind of approval? 

Chairman Chaffetz. Ms. Costello, we have to — I need you to 
bring your chair up and sit next to Mr. Linick, if you would, be- 
cause we need to be able to capture that for our recording pur- 
poses. 

She was sworn. 

Ms. Costello. I was. 

Chairman Chaffetz. Yes. 

Ms. Costello. Can you hear me? 

Chairman Chaffetz. Yes. 

Ms. Costello. Okay. 

So, in order to exclusively use personal email for official busi- 
ness, Secretary Clinton would have required approval. 

The reason we know this is because the officials we interviewed 
at the Department, both in the Office of Diplomatic Security and 
the Office of Information Resource Management, told us that. And 
in telling us that, they were relying on a department policy that 
was put in place in 2005, which says that day-to-day operations 
must be conducted — I’m paraphrasing, but must be conducted on 
authorized information systems. 

And so the implication there is any exclusive use would be a day- 
to-day operation and shouldn’t occur without approval. 

Mr. Meadows. So that created a red flag for your investigative 
team. 

Ms. Costello. As we reviewed the policies that were in place by 
the Department, yes. It was something that we considered very 
carefully in evaluating the evidence that we obtained. 

Mr. Meadows. So her statement that this is undisputed would 
not be accurate. So I won’t make you make a reference to the rest 
of it, but obviously it’s disputed if we’re disputing it here today. 

Ms. Costello. I would say that, in relying on the interviews that 
we conducted with the officials at the Department who would be 
the people responsible for implementing these policies, the answer 
is, yes, it’s disputed. 

Mr. Meadows. So they would dispute it. 

Ms. Costello. They did. 

Mr. Meadows. Okay. And they did, all right, for the record. 
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So let me go on a little bit further. Because who — so you men- 
tioned who had the obligation. I guess, how difficult would it be to 
comply with the law, the Federal Records Act, if you are using your 
personal email account? What would you have to do? 

Ms. Costello. Well, I want to draw a distinction here, because 
what we were just talking about were the cybersecurity provisions 
at the Department, and now we’ve switched a little bit 

Mr. Meadows. But to Federal records, wouldn’t she have had to 
have printed out those emails and kept those to be in full compli- 
ance with the regulation? 

Ms. Costello. Yes. During her tenure, folks in the Office of the 
Secretary, in order to comply with email records preservation and 
management policies at the Department, needed to print and file 
those emails. Now, you can 

Mr. Meadows. So, out of the 30,000 emails that we’ve had testi- 
mony earlier today, how many printed copies of emails — of her 
emails did you find? 

Ms. Costello. I don’t know. But I can say that we did find, as 
we reviewed other folks’ emails and hard-copy files, we did find 
some examples of Secretary 

Mr. Meadows. So in more than a thousand printed? 

Ms. Costello. I’m sorry, I can’t hazard a guess on that. I really 
don’t know. 

Mr. Meadows. All right. So can we get copies of all those printed 
emails through FOIA or through subpoena? 

Mr. Linick. Well, those — those emails 

Mr. Meadows. Because that’s the whole reason for the Federal 
Records Act, is so it would be — so you’re suggesting that there is 
a universe of printed-out emails that we can find. 

Ms. Costello. To the extent that other folks who Secretary Clin- 
ton emailed did go ahead and print and file 

Mr. Meadows. Oh, so you’re saying she didn’t print any of them 
out. 

Ms. Costello. Right, but they do exist. 

Mr. Meadows. Oh, okay. That’s a big difference. So she made no 
printed copies in order to comply with the law. That was somebody 
else perhaps printing it out and she happens to be communicating 
with them. 

Ms. Costello. Correct. And I’m sorry if I wasn’t clear before. 

Mr. Meadows. Okay. No, that’s good. 

Ms. Costello. What 

Mr. Meadows. I’m out of time. 

Ms. Costello. — I’m saying is that they exist in the Department. 
A few here and there do. 

Mr. Meadows. All right. 

I will yield back. Thank you, Mr. Chairman. 

Chairman Chaffetz. Thank you. 

And I think the point that certainly Mr. Gowdy was making is, 
if those emails on a private server were mailed to somebody else 
who is not involved in the government, then there is no printed- 
out copy as required. 

We’ll now go to Mr. Walberg of Michigan. 

Mr. Walberg. I thank the chairman. 

And thanks to the panel for being here. 
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Mr. McCullough, what is the significance of special access pro- 
grams? 

Mr. McCullough. It is the highest level of sensitivity in terms 
of classification information in the Federal Government. 

Mr. Walberg. The highest level, so heyond classified. Secret 

Mr. McCullough. It’s the most sensitive information the gov- 
ernment has, sir. 

Mr. Walberg. How does that classification then relate to the 
other categories classified as information such as Confidential, Se- 
cret, and Top Secret? In other words, why is it determined to he 
the most sensitive? 

Mr. McCullough. So you have several levels of confidentiality 
classification in the Federal Government. You’re starting with Con- 
fidential. That’s the parenthesis, C, close parenthesis. That’s the 
lowest level of classification. You go up there from the — to the Se- 
cret level, and then you go to the Top Secret level. 

And then each of those levels may have handling caveats that 
are trigraphs, such as ORCON, SCI, and what you’re asking about 
is SAP. So the SAP information would he characterized as the most 
sensitive — among the most sensitive information that we have in 
the government in terms of classification. 

Now, you classify things based upon the relative likelihood of 
damage to the national security if the information happens to be 
released. That’s an assessment that each person makes in OCA. 
That’s an original classifying authority. They make that assess- 
ment when they do classify something. I’m talking about original 
classification. 

Mr. Walberg. Okay. 

Mr. McCullough. Now, derivative classification, you’re just tak- 
ing it straight from the OCA’s classification and carrying it over. 
You don’t question whether or not the OCA was correct in calling 
it Secret, SI; you bring it over. 

Mr. Walberg. Okay. 

On January 19, 2016, you wrote to the chairman of the Senate 
Intelligence Committee — or Intelligence and Foreign Relations 
Committees, saying that the State Department subsequently an- 
nounced later, as a result of that letter, that it would withhold 
seven email chains because they referenced materials on special ac- 
cess programs. 

In your letter, you said you had not received a declaration from 
a second intelligence community element as of that time. Did you 
ever receive one? 

Mr. McCullough. Yes, sir. That intel element provided their 
declaration — I believe two declarations directly to the Congress via 
their own IG, via their agency IG. 

Mr. Walberg. Is it your experience that senior government offi- 
cials are often unaware of the significance of special access pro- 
gram designations? 

Mr. McCullough. No, sir. That’s not my experience. 

Mr. Walberg. So it’s a normal and expected understanding 

Mr. McCullough. Absolutely. 

Mr. Walberg. — that senior officials should have. 

Mr. McCullough. Absolutely. 
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Mr. Walberg. Let me ask both of you then, have either of you 
in your careers ever seen a situation before where special access 
program information was discussed over unclassified systems? 

Mr. McCullough. No. I can’t recall — I’ve had a fairly extensive 
career in the IG world. I was an FBI agent for 10 years, I was the 
head of investigations at the NSA for 8, and I have been the IC 
IG for about 5. I can’t recall a situation where I have come across 
this particular situation, no. 

Mr. Walberg. Mr. Linick? 

Mr. Linick. Well, I haven’t, but I haven’t been in this — I haven’t 
really been working in this space, in terms of, you know, I don’t 
have a lot of opportunity to assess whether others are disclosing 
special access information. But I haven’t seen it in my career. 

Mr. Walberg. What repercussions, Mr. McCullough, come 
from 

Mr. McCullough. Well — and I’ll just qualify my answer. That’s 
not to say it hasn’t happened. We do get — in the intel community, 
when you’re dealing with intel information every day, especially for 
the agencies we call the big six, the purely intel agencies, we have 
employees who are dealing with only classified information all the 
time, and so there are issues we run into. 

And in terms of the consequence for that, I couldn’t prejudge 
what a consequence would be in terms of a security process or an 
administrative — a misconduct process. But it certainly would be 
something where the security elements for the intelligence agencies 
would look at readjudicating the clearance, and it would be a sig- 
nificant factor in the readjudication. 

But it’s a case-by-case basis for these types of things. There are 
a lot of factors involved. 

Mr. Walberg. But there would be repercussions, undoubtedly, as 
a result of 

Mr. McCullough. Yes. There would be consequences, yes. 

Mr. Walberg. Okay. Thank you. 

Chairman Chaffetz. I thank the gentleman. 

Mr. Walberg. I yield back. 

Chairman Chaffetz. I’d ask unanimous consent to enter into the 
record a series of memoranda from both the Department of State 
inspector general and the ODNI inspector general. 

And, without objection, so ordered. 

Chairman Chaffetz. We’ll now recognize the gentleman from 
Georgia, Mr. Carter, for 5 minutes. 

Mr. Carter. Thank you, Mr. Chairman. 

And thank you, gentlemen, for being here. 

Mr. Linick, in May of 2016, you submitted a report on the Sec- 
retary of State’s email records management. And you referred to 
two separate incidents in 2011 in which then-Secretary Clinton’s 
private email server was targeted in hacking attack attempts. 

In January of 2011, there were two instances where a non-State 
Department employee notified Clinton’s deputy chief of staff that 
he had to shut down her server because he believed someone was 
trying to hack in. The next day, then-Secretary Clinton’s deputy 
chief of staff for operations, Huma Abedin, told senior staff not to 
email sensitive information over Clinton’s server. 

Is that true? 
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Mr. Linick. That’s what we reported, and that’s contained in the 
documents we reviewed. 

Mr. Carter. Okay. 

On May 13, 2011, after two of Secretary Clinton’s immediate 
staff discussed Clinton’s concern that someone was hacking into 
her email after she received a suspicious link. Secretary Clinton re- 
ceived another email with a suspicious link from an under sec- 
retary. She replied to the email directly, asking if the under sec- 
retary had really sent that email, since she was worried about 
opening it. 

Is this best practices? Is this the way you’re supposed to — ^you 
know. I’m no expert on the Internet or anything, but my kids al- 
ways told me, no, don’t open it. 

Mr. Linick. Well, I can’t speak to what’s best practices in that 
community. I mean, I think I probably would 

Mr. Carter. But is that the way you should respond to a sus- 
picious email, especially after you’ve already had staff warning you 
that someone may be hacking into it and that you’re concerned 
that it’s being hacked into? 

Mr. Linick. Well, what we reported is that, under State Depart- 
ment rules, you’re supposed to report when you believe you’ve been 
hacked. And that was where they fell short. They didn’t report 
those. 

Mr. Carter. So they did not report. Even though Ms. Clinton be- 
lieved that she was being attempted to be hacked into, she did not 
follow State Department rules and report it. 

Mr. Linick. That’s correct. 

Mr. Carter. This is Hillary Clinton we’re talking about, the Sec- 
retary of State? 

Mr. Linick. That’s right. 

Mr. Carter. That’s the one? Okay. I just want to make sure. 

By responding to that email, do you think that Secretary Clinton 
may have allowed an attacker to — a hacker to gain access to her 
emails? 

Mr. Linick. I really would have no knowledge and ability to an- 
swer that question, whether she may have allowed an attacker. Ob- 
viously, it’s a risk. And that’s why it’s required to be reported, be- 
cause of the risk. It’s a risk. 

Mr. Carter. I was about to say, that’s why we have the policy 
in place. 

Mr. Linick. It’s a risk. 

Mr. Carter. Sure, it’s a risk. 

Mr. Linick. Yeah. 

Mr. Carter. And I guess that’s where we get the “extremely 
careless,” whatever it was. 

Anyway, Mr. Linick, at any time during your investigation, did 
you see evidence — and this is important. Please hang with me here, 
okay? At any time during your investigation, did you see evidence 
of Clinton’s staff knowing that her server, the server, was unsecure 
yet they still sent sensitive information over it? 

Mr. Linick. I’m not able to say that. We know from the records — 
we were not able to interview a number of folks, but we know from 
email records that there was discussions about the server. Whether 
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they knew it was secure or unsecure, I don’t have any evidence 
about that. 

Mr. Carter. No evidence about it. 

Mr. Linick, if Hillary Clinton’s private email server was as se- 
cure as she has time and again assured us that it was, saying it 
was safe and secure, then why would her staff be so concerned? 

I mean, you stated in your report, her staff showed a concern, 
don’t use — don’t open this email, don’t use this, because we think 
you’re being hacked into. Yet we have been told by her that it was 
perfectly safe and secure. Isn’t that true? 

Mr. Linick. We weren’t able to interview her staff, so I’m not 
able to comment on what they were thinking at the time. 

Mr. Carter. You know, I think, Mr. Linick, that it’s pretty clear 
that the Secretary actively jeopardized the network and national 
security, as well. I think any rational person would understand 
that this is what happened. 

I hope that you’ll continue to investigate this. And I hope that 
you will report back to Congress any information that you might 
get. 

Mr. Chairman, I’ll yield back. 

Chairman Chaffetz. I thank the gentleman. 

We’ll now recognize the gentleman from Wisconsin, Mr. 
Grothman, for 5 minutes. 

Mr. Grothman. Yeah, I’d like to follow up a little bit more on 
these emails, okay? 

I mean, you guys were investigating the Benghazi thing. A sub- 
poena was issued for the Benghazi documents. Could that have in- 
cluded documents that were emails that she sent or received on her 
private server? 

Mr. Linick. We didn’t investigate Benghazi. 

Mr. Grothman. Oh, I’m sorry. I’m sorry. 

Mr. McCullough. Yeah, we weren’t involved in Benghazi either. 

Mr. Grothman. Right, right, right. But do you believe on her pri- 
vate email there could have been documents related to Benghazi? 

Mr. Linick. I would be speculating. I don’t have an answer for 
that. 

Mr. Grothman. Is it possible? It’s her private email. 

Mr. Linick. Again, that wasn’t part — I 

Mr. Grothman. Okay. Let me put it this way. 

Mr. Linick. I don’t know. 

Mr. Grothman. With regard to freedom of information, you have 
determined that there is no question that she had work emails on 
her private server, right? 

Mr. Linick. Yes, that’s true. 

Mr. Grothman. That’s incontrovertible, okay? If she had work 
emails on there, whatever they were about — might have been about 
Benghazi, might have been about the Clinton Foundation and, you 
know, whatever’s going on there that maybe wasn’t right — how 
long was she supposed to hold on to the emails, the work emails, 
after she left her office? 

Mr. Linick. Well, as we stated in our report, the rules require 
that she surrender official records upon her departure. The same 
rules applied to Powell, as well. And so, at that time, when she left 
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the Department, those emails should’ve gone back into the agency 
recordkeeping system. 

Mr. Grothman. Okay. She didn’t surrender them. But if she 
would’ve surrendered them, how long would they have held on 
though those emails, work-related emails related to the Secretary 
of State? Let’s say she did the right thing. She leaves office on 
whatever it was, January of 2013; how long would those emails be 
held by the government? 

Mr. Linick. Well, that — I don’t know the answer to that ques- 
tion. That’s unclear. I mean, one of the things in our report was — 
we stated is that they didn’t do such a great job preserving emails 
at that time. And so their systems that were in place weren’t 

Mr. Grothman. Give 

Mr. Linick. So I don’t have an answer to that question, because 
it’s not clear to me how long they would’ve been preserved. 

Mr. Grothman. I’ll ask you both, because I think the answer 
should be obvious. 

Maybe the departments weren’t doing the right things, but if you 
get a freedom-of-information request, say, for something that hap- 
pened 2 years ago, these agencies are supposed to have it, right? 
Are you guys subject to freedom of information? 

Mr. Linick. Oh, sure. They’re supposed to maintain 

Mr. McCullough. Right. 

Mr. Grothman. Right. So if I ask you guys a freedom-of-informa- 
tion request on something you guys were doing 2-1/2 years ago, 
you’d be able to pull that up for me, couldn’t you? 

Mr. Linick. Well, again, so long as the record is 

Mr. Grothman. You should be able to 

Mr. Linick. — in the agency’s possession. 

Mr. Grothman. — right? Assuming somebody didn’t screw up. 

Mr. Linick. Some records are disposed of — I mean, there are 
timeframes. But 

Mr. Grothman. Minutiae. But most things, you would be able to 
find things that you worked on 2-1/2 years ago, right? 

Mr. Linick. You would hope. 

Mr. Grothman. Otherwise, why even have a Freedom of Infor- 
mation Act? 

Okay. I guess what I’m getting to, not only did she not turn them 
over, as you’re saying she should have — correct? — but if she wasn’t 
going to turn them over, wouldn’t it have more prudent to hold on 
to them? 

Mr. Linick. I’m not sure I follow you. What 

Mr. Grothman. Okay. If I want to know something that was 
going on in the Secretary of State’s office in 2012 and I made a 
freedom-of-information request, the first thing they would do is 
look at the records that they are holding on to, right? 

And if Mrs. Clinton did not turn over the records as she was sup- 
posed to under law, we might contact her and say, “Hey, Mrs. Clin- 
ton, we have a freedom of information request here. Do you have 
any records dealing with the year 2012?” Right? Isn’t that what 
you think would happen? 

Mr. Linick. I don’t know. I mean, possibly. 

Mr. Grothman. Kind of frustrating here. 
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Do you think it was right for her to dispose of these records? This 
is when she was still Secretary of State. Would it have been right 
for her to erase work-related emails? 

Mr. Linick. Well, if they count as Federal records, she’s supposed 
to make them part of an agency recordkeeping system. 

Mr. Grothman. Right. 

Mr. Linick. That’s clear. 

Mr. Grothman. Right. 

Mr. Linick. So, if she didn’t turn over records that are part of 
the agency recordkeeping system, then she would be violating State 
Department rules requiring her to do so. 

Mr. Grothman. And if she would’ve, they would still be avail- 
able, unlike being erased by her lawyers, right? 

Mr. Linick. So I don’t 

Mr. Grothman. Assuming somebody didn’t screw up in the State 
Department. 

Mr. Linick. Well, I don’t know if they would’ve been maintained 
because we found systemic issues with records preservation. So 
it’s — I can’t tell you for sure 

Mr. Grothman. They should’ve been maintained. I’ll put it that 
way. 

Mr. Linick. Absolutely. 

Mr. Grothman. Absolutely. So, absolutely, if somebody makes an 
open-records request, be it about the Clinton Foundation, be it 
about Benghazi, whatever, in the year 2014, the State Department 
should’ve been able to say, here are the emails related to that, 
right? 

Mr. Linick. Sure. 

Mr. Grothman. Absolutely. And they didn’t and couldn’t because 
they were erased by Secretary Clinton. 

Mr. Linick. I don’t know if they were erased, but the bottom line 
is there were, you know, 50,000 pages 

Mr. Grothman. Well, we heard 

Mr. Linick. — of emails that were not returned to the Depart- 
ment. 

Mr. Grothman. We heard when the FBI testified that tens of 
thousands of emails were erased. So I think we can assume — and 
some of those they were able to retrieve; we know they were work- 
related. 

So I guess that’s the point, was something wrong done there. To 
erase work-related emails so, as a result, a freedom-of-information 
request cannot be fulfilled, is there something wrong with that, 
very wrong with that? 

Mr. Linick. Well, again, in they’re agency records, they should 
be part of the agency recordkeeping system. 

Mr. Grothman. In other words, work-related emails. 

Mr. Linick. Well, they’d have to fall within the definition of an 
agency record, which is anything that documents the, you know, 
deliberations, the agency transactions, those kinds of things, not 
personal matters or not logistical matters. 

Mr. Grothman. Right. Work-related. 

Mr. Linick. Work-related. Correct. 

Mr. Grothman. So when the FBI testifies, as they did, like, an 
hour ago, that they found work-related emails that had been 
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erased, there was something clearly wrong there, because those 
emails should’ve been available in case somebody was making a 
freedom-of-information request. 

Mr. Linick. They should have been surrendered to the Depart- 
ment when she left. 

Mr. Grothman. Surrendered, and they should have been avail- 
able. 

Mr. Linick. Right. 

Mr. Grothman. Thank you. 

Chairman Chaffetz. I thank the gentleman. 

A couple quick more questions, and then we’re getting near the 
end here. 

Ms. Costello, electronic records fall under — electronic records fall 
under the jurisdiction of the Federal Records Act, correct? 

Ms. Costello. Yes, they do. 

Chairman Chafeetz. Mr. Linick, do you believe — I’m going to 
ask you both questions, so go ahead and stay. 

Does this include — so electronic records fall under the jurisdic- 
tion of the Federal Records Act, right, Mr. Linick? 

Mr. Linick. So long as they contain work-related materials, yes. 

Chairman Chaffetz. Does this include video? 

Mr. Linick. Well, if you’re — if you’re asking about the videotape, 
the separate issue, I mean, that’s something we’re looking at, and 
we’re really not able to comment on it at this time. I mean, that’s 
an ongoing matter, whether videos are records. But we’re looking 
at that issue. 

Chairman Chaffetz. Let’s get — is this relating to the 8 min- 
utes — 

Mr. Linick. Right. 

Chairman Chaffetz. — of deleted videos? 

Mr. Linick. Right. 

Chairman Chaffetz. So the inspector general is doing an inves- 
tigation. 

Mr. Linick. Well, we’re looking — where we’ve done it — we’ve 
started a preliminary review, and we’re looking into that matter at 
this point. We have not opened a full-blown investigation, but we 
are looking to see, sort of, what the issues are, and we have inter- 
viewed some people. 

Chairman Chaefetz. Well, we also have jurisdiction, and we 
would like to know. So my question is, if the electronic record is 
video, is it treated differently than if it’s text? 

Mr. Linick. I’m not able to answer that question. I mean, that’s 
beyond the scope 

Chairman Chaffetz. Why not? 

Mr. Linick. Because I just — I don’t have an answer for you. 
Again, we’re sort of in the middle of looking at those issues. It’s not 
part of the report that we issued. 

Chairman Chaffetz. Right. 

Mr. Linick. And I can only talk about what my work supports. 
But I wouldn’t want to venture a guess if 

Chairman Chaefetz. So if the personnel are paid by the Federal 
Government, the hardware is paid by the Federal Government, the 
software is paid for by the Federal Government, if somebody were 
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to tamper with that information, is that a violation of the Federal 
Records Act? 

Mr. Linick. I mean, a Federal record can be contained on any 
medium. So, potentially, it could be a record, potentially. In the 
case you’re talking about, there’s a transcript and a video, and it’s 
unclear which is the Federal record, so that’s why I’m hesitating 
here. But a Federal record can be on any — it could be on a napkin. 

Chairman Chaffetz. Could they both be? 

Mr. Linick. Again, I’m not — I’m not sure, and I don’t want to 
guess 

Chairman Chaffetz. When will you give us that answer? 

Mr. Linick. Well, we’re working on it. So we’ll 

Chairman Chaffetz. No, but I want to know what’s reasonable 
to know when you’re going to get back to us on an answer on that. 

Mr. Linick. You know, I will talk with my staff who’s doing that 
work and get back to you and let you know sort of where we are. 

Chairman Chaffetz. You’ll get back to me when? 

Mr. Linick. I’m happy to get back to you as soon as I get back 
to the office and let you know you know sort of what’s going on. 

Chairman Chaffetz. By the end of the week? Is that fair? 

Mr. Linick. Sure. 

Chairman Chaffetz. That’s tomorrow. 

Mr. Linick. Sure. 

Chairman Chaffetz. That would be most helpful. 

And I do think — it’s a very — it’s affecting the Federal record, and 
I think you need to look very closely at that. It’s something we’re 
looking at, and we need your input and your professionalism in 
saying — to me, it’s pretty clear. These are all records, whether 
they’re video, transcript. There may be photos. Certainly, if you are 
involved in law enforcement, the more of that you have, the better 
the situation. 

And we do this differently than most countries. We do preserve 
records, and we do allow the public to access this information be- 
cause they paid for it. It’s their government. That’s what the Free- 
dom of Information Act is all about. And when things are there and 
then deleted on purpose, then there’s a cloud of mystery that needs 
to be rectified. And I look forward to hearing back from you. 

The emails, the classified Hillary Clinton emails, can you provide 
us those classified emails? 

Mr. Linick. Well, we didn’t look at the classified emails. So that 
wasn’t part of our review. I mean, maybe Mr. McCullough can an- 
swer that question. I’m 

Chairman Chaffetz. Mr. McCullough? 

Mr. McCullough. Certainly, I can provide you what — and I be- 
lieve we have provided Congress with everything that we had. We 
can certainly — it’s over in Senate security. We provided it to SSCI, 
I believe, and HPSCI also. 

Chairman Chaffetz. Can you provide this committee in a secure 
format the classified emails? 

Mr. McCullough. I can to a certain extent. I cannot provide a 
certain segment of — because the agency that owns the information 
for these emails has limited the distribution on those. So they’re 
characterizing them as ORCON. So we have 

Chairman Chaffetz. Explain what “ORCON” is. 
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Mr. McCullough. Originator control. So I can’t — I can’t give 
them to even Congress without getting the agency’s permission to 
provide them. So they have been provided 

Chairman Chaffetz. Which agency? 

Mr. McCullough. I can’t say that here in an open hearing, sir. 

Chairman Chaffetz. So you can’t even tell me which agency 
won’t allow us, as Members of Congress, to see something that Hil- 
lary Clinton allowed somebody without a security clearance in a 
nonprotected format to see? That’s correct? 

Mr. McCullough. This is the segment of emails — this is why my 
letter back to Ranking Member Cummings had to be classified, be- 
cause people would like to see this segment of emails. And this has 
been an issue not just with you and your committee but with sev- 
eral Members at this point. 

So we have gone back to the agency that is involved several 
times, and I can — we can certainly do that again and ask permis- 
sion. 

Chairman Chafeetz. Can you generally tell me, is it because 
they are so sensitive about signals intelligence? Human intel- 
ligence? What 

Mr. McCullough. We shouldn’t get into the content of these 
emails in an open hearing. 

Chairman Chafeetz. Okay. I don’t want to violate that, but the 
concern is it has already been violated, and it was violated by Hil- 
lary Clinton. And it was her choice. She set it up, and she created 
this problem, and she created this mess. We shouldn’t have to go 
through this, but she did that. 

Mr. McCullough. This is the — this is the segment of emails 
that I had to have people in my office read in to particular pro- 
grams to even see these emails. We didn’t possess the required 
clearances and compartments. 

Chairman Chaffetz. So even the inspector general for ODNI 
didn’t have the requisite security clearance. 

Mr. McCullough. That’s right. That’s correct. They’d have to 
get read-ins for them. 

Chairman Chafeetz. Wow, wow, wow, wow. Unbelievable. What 
a mess. 

I’ll yield back. The gentleman from Maryland, Mr. Cummings. 

Mr. Cummings. A while back, and it has been a good while, when 
we had the stimulus program, back in 2009, I guess, Mr. Devaney, 
who was, I think, in charge of it, he said something I’ll never for- 
get. He said — you know, we were talking about how do you control 
the money and make sure that nobody does anything wrong. He 
said: I’d rather do things upfront so that people never commit an 
offense than to have them commit an offense and then they’re in 
trouble. 

And I’m trying to figure out — I’ve got to tell you, this whole thing 
of classification really bothers me, and it bothers me because I 
think it’s so unfair. I think, I mean, somebody is going to classify 
something later on, you all just — I mean, your offices — I mean, 
well. Intelligence and State disagree. 

As a matter of fact, I was looking at something where there was 
a disagreement between State and the Intelligence a while back. 
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and Senator Corker had sent a letter, wrote a letter to the State 
Department about one of these disputes last year. 

And the State Department responded in September, and I quote: 
“Your letter focused on an email chain that someone within the in- 
telligence community claims should have been redacted as secret. 
Our experience is that this process may in some instances result 
in the IC wrongly assuming that information in the emails origi- 
nated with the IC, when it may instead have been based upon 
other sources, given the wide range of context maintained by State 
Department officials,” end of quote. 

So, you know, I just — I’m wondering what your offices can do, if 
anything, it may be out of your jurisdiction, but going back to what 
Mr. Devaney said back then, is how do we make sure that people 
are not stepping into violations that they don’t even know. I mean, 
am I missing something? 

I mean, and this is serious stuff, man. You’ve got the FBI Direc- 
tor, the Department of Justice, and people can’t even agree. I’m not 
saying you should agree. But when you tell me — and I’m going to 
harp on this because I saw it in the Benghazi Committee. You 
know, you say I’m going to — ^you committed a crime or you did 
something wrong when something was upgraded later. What’s that 
about? Can you all help me? 

Mr. McCullough. There are a couple of issues in there, Mr. 
Cummings. The first, in terms of the “upgraded later,” again, the 
emails we were concerned about were not those that were up- 
graded. I believe that’s — it’s not just — it’s not unique to the State 
Department, but that seems to be a fairly common — when the 
State Department is processing a FOIA, they upgrade things before 
they’re released. 

And so that’s one subset, one bucket of emails, and that’s sepa- 
rate from the emails we’re talking about, it’s separate from the 
emails, I believe. Director Comey is talking about when he says 
there were 110. I believe that those were classified when they were 
created and sent and received. So those weren’t about being up- 
graded. 

I think — I’ve heard the term used “retroactive classification.” 
Whatever you want to call it, that is being done with some emails. 
But the emails that were the concern, I believe, in this case, were 
the emails that were classified when they were born essentially, 
when they were created. 

Mr. Cummings. But they aren’t marked, right? 

Mr. McCullough. Other than those that you discussed with Di- 
rector Comey earlier. 

Mr. Cummings. Three, three, three, three. 

Mr. McCullough. Right. I know of none that were marked that 
we looked at. 

Mr. Cummings. See, that’s — that’s what — that’s part of what I’m 
talking about. 

Mr. McCullough. Right. 

Mr. Cummings. They’ve got it all out in the press, oh, Hillary 
Clinton lied because she — and then we come to find out there were 
three that had markings of a “C,” and it was the wrong marking. 
So basically, 3 out of 30,000-plus. You see how 
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Mr. McCullough. But to your question about what can we do 
about over classification, of course, in the intelligence world trans- 
parency and classification and secrecy tend to be competing equi- 
ties. There are civil liberties, protections, offices, and privacy offi- 
cers. 

We have done as IGs over the past several years reports under 
the Reducing Over-Classification Act. Each IG would have done one 
of those for their department or agency. And the IGs now, I think, 
if they haven’t finished yet, will be in the process of doing a statu- 
tory follow-up — this was mandated from Congress — on reducing 
over-classification. So each IG is doing a review of its department 
or agency having to do with overclassification. 

Mr. Cummings. Well, I want to — I want to — I hope that the IG 
bill helps you all, I hope that helps, because we worked very hard 
on that bill, because we want you all to be effective and efficient. 
And, again, I want to thank you and your staffs for your service. 
We really appreciate all that you all do. 

Thank you very much, and thank you for being here. 

Mr. McCullough. Thank you. 

Mr. Linick. Thank you. 

Mr. Cummings. And I’m going to follow up on my 13 questions. 
All right? 

Mr. McCullough. Yes, sir. We’ll be there to brief you in person. 

Mr. Cummings. I’m looking forward to it. 

Mr. McCullough. Yes, sir. Thank you. 

Chairman Chaffetz. I now recognize the gentleman from Massa- 
chusetts, Mr. Lynch. 

Mr. Lynch. Thank you. 

I too want to thank you for your service and your willingness to 
help the committee. 

Just in closing, after all this, you know, the long investigation of 
Secretary Clinton, are we approaching — I mean, technology now 
has allowed us to have full-spectrum surveillance of people in gov- 
ernment, so that every word, every thought, every conversation, it’s 
gone beyond just capturing official records. 

But, you know, it’s actually — I think we’re at a point where it 
has a chilling effect, where you can’t even have normal discourse 
anymore. You’ve got to leave your office and have a conversation 
in the hallway, and you’ve got to make sure that other person 
leaves their cell phone aside. 

I just think it’s driving a lot of conversations underground. And, 
you know, I realize we’re on the Oversight Committee and we want 
to make sure that we have a certain level of transparency, but I 
also think that, you know, I think a lot of people in government 
will think twice. 

First of all, people will think twice about serving in government, 
and then people in government will take great pains to make sure 
that their thoughts, the open discourse, are not ever recorded be- 
cause you’re going to have a committee like this subpoenaing you 
and getting every single phone call you ever made and every email 
you ever made. 

It’s not good. It’s not — this is not a good result. And, you know, 
I know inquiring minds want to know, but it just makes it very dif- 
ficult for a government to function and it makes — and it has an im- 
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plication for the public too, because, you know, people call up — 
we’ve exempted ourselves, by the way. Congress, for good reason. 

But, you know, the public has to interact with us. And so those 
phone calls, those emails back and forth, people petitioning their 
government, that’s all subject to surveillance as well. You know, I 
just think we’ve reached the tipping point here, and I’m just curi- 
ous if you think about that at all. 

Mr. McCullough. Yes, sir. One aspect and one area where we 
think about that has to do so with whistleblower communications. 
So as IGs, we deal with the public a lot also. Many of them are 
current or former government employees or contractors, and so we 
have, over the past couple of years, had to balance that out too, the 
need for security, the need for counterintelligence, which is sac- 
rosanct. We have to protect secrets. 

On the other hand, we have to have people feel comfortable as 
whistleblowers to come to an IG and make a complaint about a 
law, rule, or regulation. 

So I share your concern there, and that is something — I chair the 
Intelligence Community Inspectors General Forum. It’s all 17 Intel 
agencies. And it’s something that our forum has had a lot of discus- 
sion about, frankly. 

But we feel as though we’ve at this point struck a manageable, 
livable balance with the agencies and management so that people 
can feel comfortable coming to an IG and complaining to us with- 
out fear of their communications being used against them. And if 
they are, then we have reprisal statutes. 

Mr. Lynch. Yeah. 

Mr. McCullough. And as Mr. Cummings said, this act is going 
to help strengthen us also, and so we investigate reprisal when 
that does happen. 

Mr. Lynch. No, I mean, you see it in the pushback. State De- 
partment has a, you know, a culture where, you know, all these 
people — going back to Condoleezza Rice and Secretary Powell, Sec- 
retary Clinton — people using private communication devices, that’s 
all to get out from underneath this, you know, constant surveil- 
lance. 

So I don’t know. At some point we’ve got to just try to strike that 
right balance. Sometimes it’s difficult. 

I yield back. 

Chairman Chaffetz. I thank the gentleman. 

I want to thank our witnesses here today. I want to thank the 
inspector general community in general. You’ve got a lot of good 
men and women who poured their heart and soul in a lot of their 
work, you know. My biggest fear is that we don’t read it, digest it, 
and then act on it. But we’re committed to doing that as much as 
possible. 

Your looking under the hood, your recommendations, your find- 
ings, they’re pivotal for us to do our jobs here in Congress, and I 
just want to thank those men and women. I hope you carry that 
message back to each of your organizations. 

I also want to personally thank the three of you for spinning on 
a dime and being here so swiftly. We did do this around the FBI 
Director’s availability. When I spoke with him on the phone on 
Tuesday, I asked him which day would be most convenient and he 
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said Thursday. So that’s why we ended up on Thursday, and we 
all spun around that and you did as well. And so I thank you for 
the swift manner in which you made yourselves available and the 
interaction you have had with the committee. 

I do want to make sure we follow up on Mr. Cummings’ ques- 
tions and requests. And I do, Mr. Linick, really, and Ms. Costello, 
want to make sure that we get that information about electronic 
records as it relates to videos and those types of things. 

Chairman Chaffetz. Again, I thank you for being here. It has 
been a good, long day, but fruitful and important work. The com- 
mittee stands adjourned. 

[Whereupon, at 4:04 p.m., the committee was adjourned.] 
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Richard W. Painter 

S. Walter Richey Professor of Corporate Law 
University of Minnesota Law School 


My 6,2016 


To the Members of the U.S. House Committee on Oversight and Government 
Reform: 


I write to you about FBI Director James Comey, who I understand has been called 
to testify before your Committee. 1 understand that the testimony will concern his 
recommendation that the Justice Department not pursue criminal charges in 
connection with former Secretary of State Hillary Clinton’s use of a private email 
server for official government business, including some classified information. 


I have known Mr. Comey since we served together in the Administration of 
President George W. Bush. Mr. Comey is a man of the utmost integrity and he 
was uniquely suited for the role of United States Attorney and then Deputy 
Attorney General. He called the shots as he saw them without regard to political 
affiliation or friendship. He relentlessly prosecuted lawbreakers and refrained 
from prosecuting when it was not warranted by the evidence. 


Throughout the FBIs recent investigation of Secretary Clinton’s email seiwer, I 
have been convinced that Mr. Comey would supervise the investigation with 
impartiality and strict adherence to the law as well as prosecutorial precedent. 
Although I am aware of very few prosecutions for carelessness in handling 
classified infonnation, as opposed to intentional disclosure, I knew that Mr. Comey 
would recommend prosecution in any and all circumstances where it was 
warranted. I cannot think of someone better suited to handle such a politically 
sensitive investigation. 
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Now that the investigation is concluded, I sincerely hope that your Committee will 
give Mr. Comey the courtesy of allowing him - once again — to explain the 
rationale for his recommendations. Although your Committee is entitled to ask 
him questions about any alleged impropriety in the course of the investigation, 1 
cannot imagine that there has been any. I also ask that your Committee treat Mr. 
Comey with the respect that he deserves. 


Finally, I urge all Members of the United States Congress to desist from interfering 
in specific prosecutorial decisions, particularly those involving political allies and 
opponents. During my tenure in the White House there were very unfortunate 
allegations that powerful senators sought politically motivated firings of United 
States Attorneys. Whether or not such allegations were true, it is imperative that 
Members of the Senate or House never again conduct themselves in a manner 
where such interference could be suspected. It is also imperative that the Executive 
Branch do everything possible to assure the independence of federal law 
enforcement. Mr. Comey’s leadership of the FBI and his supervision of this 
highly sensitive investigation have been a step in the right direction. We should 
all be proud of his service to our Country. 


Respectfully, 


/s/ 

Richard W. Painter 
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January 2016 

OFHCE OF EVALUATIONS AND SPECIAL PROJECTS 


Evaluation of the Department of State's FOIA Processes for 
Requests bwolving the Office of the Secretary 


LIGHTS 


What OIG Found 

S/ES is responsible for coordinating searches for FOIA requests 
for records held by the Office of the Secretary. When a FOIA 
request of that nature is received by the Department, the Office 
of Information Programs and Services (IPS) within the Bureau of 
Administration notifies S/ES. S/ES reports its findings to IPS, 
which then communicates with the FOIA requester. 


"'■''"■'VieW''Report 

What OIG Reviewed 

As part of ongoing efforte to rospood-lO 
requests from the current Secretary of ^ate 
and several Members of Congress, the ' 
Office of Inspector Genera! (OIG) evaluated : 
efforts undertaken by the Department of . ■ 
State (Department) to ensure that recpixiste 
aie properly produced in response to 
Freedom of Information (FOIA) requests 
involving past and current Secretaries of 
State. Thi.s report addresses (1) ^e 
Department's compliance with FOIA ' 
statutory and regulatory requirements and> 
(2) the effectiveness of thejprocesses usedS 
by the Office of the Secre^ifiy's Executive 
Secretariat (S/ES)to respo^ to FOIA 
requests. 


OIG's past and current work demonstrates that Department 
leadership has not played a meaningful role in overseeing or 
reviewing the quality of FOIA responses. The searches performed 
by S/ES do not consistently meet statutory and regulatory 
requirements for completeness and rarely meet requirements for 
timeliness, S/ES currently searches Department email accounts 
only if a FOIA request mentions emails or asks for "all records," or 
if S/ES is requested to do so during the course of litigation. 
However, FOIA and Department guidance require searching email 
accounts when relevant records are likely maintained in these 
accounts. In addition, although FOIA requires agencies to respond 
to requests within 20 working days, some requests involving the 
Office of the Secretary have taken more than 500 days to process. 
These delays are due, in part, to the Department's insufficient 
provision of personnel to IPS to handle its caseload. 
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These problems are compounded by the fact that S/ES FOIA 
responses are sometimes inaccurate. Officials in IPS and attorneys 
for the Department identified instances in which S/ES reported that 
records did not exist, even though it was later revealed that such 
records did exist. Procedural weaknesses in S/ES FOIA processes 
appear to be contributing to these deficiencies. For example, S/ES 
management is not monitoring search results for accuracy, and IPS 
has limited ability to conduct oversight. S/ES also lacks written 
policies and procedures for responding to FOIA requests. Finally, 
staff in S/ES and other components in the Office of the Secretary 
have not taken training offered by IPS to better understand their 
FOIA responsibilities. 
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In September 2015, the Department appointed a Transparency 
Coordinator to improve the Department's FOIA process, among 
other things. 
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OBJECTIVES AND METHODOLOGY 


In April 2015, the Office of Inspector General (OIG) initiated an evaluation to address concerns 
identified during recent audits and inspections* and to respond to requests from the current 
Secretary of State and several Members of Congress involving a variety of issues, including the 
use of non-Departmental systems^ to conduct official business, records preservation 
requirements, and Freedom of Information Act (FOIA) compliance. This report, which is one of 
several documenting OIG's findings in these areas, addresses efforts undertaken by the 
Department of State (Department) to ensure that government records are properly produced in 
response to FOIA requests involving past and current Secretaries of State. Specifically, this report 
assesses (1) the Department's compliance with FOIA statutory and regulatory requirements and 
(2) the effectiveness of the processes used by the Office of the Secretary, Executive Secretariat 
(S/ES), to respond to FOIA requests, OIG has already issued findings related to one aspect of the 
FOIA process used to review and release 55,000 pages of emails that former Secretary of State 
Hillary Rodham Clinton provided to the Department in December 2014.* OIG will report 
separately on issues associated with the use of non-Departmental systems to conduct official 
business and records preservation requirements. 

In planning this work, OIG drew on FOIA, and related regulations and guidance issued fay the 
Department, and Standards for Internal Control in the Federal Government^ To gain an 
understanding of the Department's FOIA processes, controls, and policies and procedures, OIG 
interviewed the Under Secretary for Management, the Assistant Secretary for the Bureau of 


’ OIG has identified the following issues: inconsistencies across the Department in identifying and preserving records, 
hacking incidents and other issues affecting the security of Department electronic communication, delays and other 
problems related to processing FOIA requests, and concerns about an Ambassador's use of private email to conduct 
official business, .Fee OIG, Review of State Messaging and Archive Retrieval Toolset and Record £ma//(ISP-I-15-15, 
March 2015); OIG, Audit of the Department of State Information Security Program lAUD-ll-lS-ll, October 2014); 

OIG, Management Alert: OIG Findings of Significant and Recurring Weaknesses in the Department of State 
Information System Security Program {A\JO-Vt-14-04, November 2013); OIG, Inspection of the Bureau of 
Administration, Global Information Services, Office of Information Programs and Services (ISP-I-12-54, September 
2012); and OIG, Inspection of Embassy Nairobi, Kenya (ISP-I-12'38A, August 2012). 

* For purposes of this work, OIG uses the term 'non-Departmental systems" to mean hardware and software that is 
not owned, provided, monitored, or certified by the Department of State. 

* OIG, Potential Issues Identified by the Office of the Inspector General of the Intelligence Community Concerning the 
Department of State 's Process for the Review of Former Secretary Clinton 's Emails under the Freedom of Information 
Acf (ESP-15-04, July 17, 2015). This report made four recommendations to strengthen the Department's review of 
records prior to release: (1) requesting staff support from intelligence community FOIA offices to assist in the 
identification of IC equities, (2) facilitating a review of records by IC FOIA officials to ensure that the Department's 
Classified Network is appropriate for storage of FOIA material, (3) seeking classification expertise from the interagency 
to act as a final arbiter if there is a question regarding potenb'ally classified material, and (4) incorporating the 
Department of Justice into the FOIA process to ensure the legal sufficiency review of the FOIA exemptions and 
redactions. In response, the Department agreed with recommendations 1 and 4, but did not agree with 
recommendations 2 and 3. 

Government Accountability Office (GAO), Standards for Interna! Control in the Federal Government (GAO-U-IOAG, 
September 2014). 
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Administration (A), and various officials in the Office of Global Information Services (A/GIS) and 
S/ES. In addition, OIG reviewed the Department's annual FOIA reports and obtained and 
analyzed a list of all FOIA requests tasked to the Office of the Secretary from 1996 to 2015. OIG 
also consulted with the National Archives and Records Administration's Office of Government 
Information Services and reviewed the FOIA procedures of other Federal agencies. OIG 
conducted this work in accordance with quality standards for evaluations as set forth by the 
Council of the Inspectors General on Integrity and Efficiency. 


BACKGROUND 


Enacted in 1966, FOIA provides that any person has a right, enforceable in court, to obtain 
access to Federal agency records, except to the extent that such records (or portions of them) 
are protected from public disclosure by one of the Act's exemptions or exclusions,® The Act 
defines "record" broadly and covers "any information that would be an agency record subject to 
the requirements of [FOIA] when maintained by an agency in any format, including an electronic 
format."® 

Upon receipt of a request for records, the agency is required to determine whether to comply 
and to notify the requester of its determination and the Justification for it within 20 working 
days.’ The notification of an adverse determination could be a denial of the request in whole or 
in part based on the statutory exemptions or a determination that no such records exist. The 
exemptions include, for example, classified information, privileged communications, and law 
enforcement information.® 

In an adverse determination, the agency must notify the requester that he or she has a right to 
appeal the determination to the head of the agency. An administrative appeal shall be decided 
within 20 working days.® If the appeal is not favorable, the requester may then file a complaint in 
Federal district court to enjoin the agency from withholding agency records and to order the 


® FOIA, 5 U.S.C. 5 552, If an exemption applies, the agency must notify the requester that a record exists but is exempt 
from disclosure. If an exclusion applies, the agency may notify the requester that no responsive records subject to 
FOIA exist. Exclusions relate to the existence of an ongoing criminal investigation, the names of informants, and 
classified foreign intelligence or counterintelligence or international terrorism records. 

® 5 U.S.C. § 552(f)(2)(A). 

’ 5 U.S.C. § 5S2(a)(6)(A)(i). In unusual circumstances, the time limit for responding to a request or an appeal may be 
extended by up to ten working days. S U.S.C. § 552(a)(6)(B). 

® 5 U.S.C. § 552(b).The nine exemptions are (1) information that is classified to protect national security, (2) 
information related solely to the internal personnel rules and practices of an agency, (3) information that is prohibited 
from disclosure by another Federal law, (4) trade secrets or commercial or financial information that is confidential or 
privileged, (5) privileged communications within or between agencies, (6) information that if disclosed would 
unwarrantedly invade another individual's personal privacy, (7) certain information compiled tor law enforcement 
purposes, (8) information that concerns the supervision of financial institutions, and (9) geological information on 
wells. 

® 5 U.S.C. § 552(a)(6)(A). This includes a determination that no responsive records exist. 
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production of any agency records the requester believes the agency improperly withheld.'” In 
addition, a requester who receives no response within 20 days has a right to file a complaint in 
district court immediately." 

At the Department, the Foreign Affairs Manual (FAM) designates the Office of Information 
Programs and Services (IPS) as responsible for the Department's compliance with FOIA." IPS is a 
part of the Office of Global Information Services, a subcomponent of the Bureau of 
Administration. The FAM also designates the Assistant Secretary for Administration as the Chief 
FOIA Officer, responsible for Department-wide FOIA compliance." The Assistant Secretary for 
Administration reports to the Under Secretary for Management.” 

IPS administers the Department's Information Access Program, which includes administering all 
requests for FOIA records. IPS coordinates, tracks, and reports on responses to all FOIA requests 
for Department records — including administrative appeals made in connection with such 
requests — and is supposed to ensure that responses are timely, accurate, and complete." The 
Department's FOIA regulations specify that FOIA requests be sent to IPS." The request must 
reasonably describe the records sought should be specific, and should include all pertinent 
details about the request including the subject timeframe, any individuals involved, and reasons 
why the Department is believed to have records on the subject of the request." 

Once a FOIA request is received, IPS logs it into the case-tracking system — the Freedom of 
Information Document Management System (FREEDOMS) — and acknowledges the request. IPS 
then determines which Department bureaus, offices, or overseas posts would possess the 
requested records and sends a search/review request transmittal (Form DS-1748) to each office 
FOIA coordinator. The form requires each office to provide information on the files searched and 
their location, the search terms used, and the time period searched, among other information. 

In 2010, the Department issued guidance to offices that describes in general terms how a search 
is to take place. 

Offices must undertake searches that are reasonably calculated to uncover all 
relevant materials. Unless otherwise noted in a given request, offices should 
conduct a search for records in any form, including paper records, email 


5 U.S.C. § 552(a)(4)(B). As an alternative to litigation, a requester may request mediation with the agency, which is 
conducted by the Office of Government Information Services in the National Archives and Records Administration. 5 
U.S.C. § 552(h)(3). 

" 5 U.S.C. § 552 (a){6)(C)(i). 

" 1 FAM 214.2. 

1 FAM 211.2(ee). Executive Order 13392 requires the designation of a Chief FOIA Officer. 

1 FAM 211.2(a) 

" U.S. Department of State, FOIA Guidance For State Department Employees {201Q). at 3. 

22 C.F.R. § 171.5(a). 

" 22 C.F.R. 5 171.5(c). 
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(including email in personal folders and attachments to email), and other 
electronic records on servers, on workstations, or in Department databases. 

Offices do not, however, need to search where there is no reasonable possibility 
of finding responsive records.'® 

Once the search office returns responsive records to IPS, IPS determines their relevance to the 
request and whether any part of them may be released to the requester or whether they are 
subject to one of FOIA's exemptions.'® IPS then prepares the formal response to the requester 
and includes any responsive records that are subject to release. If a requester files an 
administrative appeal of an adverse determination, it is adjudicated by the Appeals Review 
Panel, consisting of retired Foreign Service Officers.® 


® FOIA Guidance For State Department Employees, at 8. 

Certain offices, including the Bureau of Diplomatic Security and the Office of Medical Services, are referred to as 
"decentralized offices” and review their own documents for exemptions. However, these offices must still forward a 
copy of their response to the request to IPS. 

22 C.F.R. § 171.52. 
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Reviews records and 
identifies exemption in 
conjunction with S/ES. 


▼ 



Releases non-exempt 
records to requester. 


As shown in Figure 1, when a FOIA 
request involves documents produced by 
a Secretary of State or other officials in 
the Office of the Secretary (S), the two 
Deputy Secretaries of State (D), the Under 
Secretary for Political Affairs (P), or the 
Counselor of the Department (C), IPS tasks 
S/ES with performing a search for relevant 
documents, S/ES is responsible for the 
coordination of material presented to the 
Secretary, Deputy Secretary, and Under 
Secretaries: the implementation of 
decisions made by these officials; and the 
Department's relations with the White 
House, National Security Council, and 
other Cabinet agencies,” S/ES employs 
one FOIA Analyst, who reports to the GS- 
14 Deputy Director of Correspondence, 
Records, & Staffing (Deputy Director).” 
The Deputy Director serves as the S/ES 
FOIA coordinator and reports to the 
Director of Secretariat Staff, 

According to information provided by 
S/ES, the FOIA Analyst searches for 
relevant documents in several databases 
or tasks the relevant office (S, D, P, or C) 
with performing the search. After the 
search is completed, the Deputy Director 
conducts a review of the FOIA Analyst's 
search and the records identified. Finally, 
all identified records are sent to IPS for 
processing, along with a signed form DS- 
1748 identifying the databases searched 
and the time expended in conducting the 
search. If the request is in litigation or if 
legal guidance is sought regarding the 
search, an attorney from the Office of the 
Legal Adviser (L) may review the proposed 
response before it is released to the 
requester. 


” 1 FAM 022.2. 

A second S/ES employee occasionally assists with FOIA searches in addition to his regular duties. 
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In September 2015, Secretary of State John Kerry named a former career Senior Foreign Service 
Officer as the Department's Transparency Coordinator. The Transparency Coordinator will lead 
the Department's efforts to meet the President's Managing Government Records AmcXwe, 
respond to OIG's recommendations, and work with other agencies and the private sector to 
explore best practices and new technologies. Secretary Kerry also tasked the Transparency 
Coordinator with improving the efficiency of the Department's systems for responding to FOIA 
and congressional requests. 


THE DEPARTMENT DOES NOT CONSISTENTLY MEET FOIA LEGAL 
AND REGULATORY REQUIREMENTS 

Statutory Deadlines for Processing Requests Are Not Met 

FOIA requires agencies to respond to FOIA requests within 20 working days. However, the 
Department rarely meets this statutory deadline, even for simple requests. Although few 
agencies are able to meet the 20-day deadline for complex requests, overall compliance is 
much greater across the Federal Government than at the Department. In FY 2014, the average 
processing time for simple requests across the Federal Government was 20.5 days, and the 
Government-wide average for complex requests was slightly less than 119 days.^'* In contrast, 
the Department took four and one-half times as long — an average of 91 days to process simple 
requests and almost 535 days to process complex requests.® 

The Department has been particularly late in meeting FOIA’s timelines for requests involving the 
Office of the Secretary. Table 1, which is based on IPS data provided to OIG, shows the 
processing time for FOIA requests that were tasked to S/ES and involved the current and past 


The Department of Justice, which is required by FOIA to develop reporting and performance guidelines, defines a 
complex request as one that involves a high volume of material or requires additional steps to process, such as the 
need to search for records in multiple locations. An example of a simple request is a single individual's visa record. An 
example of a complex request is one for all records relating to the attacks on U.S. diplomatic facilities in Benghazi, 
Libya, which covers multiple bureaus and offices of the Department 5eeU.S. Department of Justice, Guide to the 
Freedom of Information Act {2QQS). 

U.S. Department of Justice, Summary of Annua! FOIA Reports For Fiscal Year 2014, pp. 12--14. 

U.S. Department of State, Freedom of Information Act Annual Report, Fiscal Year 2014, p. 28. In its 2015 analysis of 
the performance of the 15 Federal agencies that consistently receive the most FOIA requests, the Center for Effective 
Government rated the Department as the lowest scoring agency by far. Its analysis demonstrated that the Department 
processed only 17 percent of the FOIA requests it received in 2013. Center for Effective Government, Making the 
Grade: Access to Information Scorecard 2015 {March 2015), p. 2. The Department's Chief FOIA Officer attributed these 
delays to (1) a large increase in requests and (2) an increase In complex requests. The Department’s requests have 
increased in recent years: however, this increase in requests exists across the Federal Government and is not unique to 
the Department. 
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four Secretaries of State. “ Only 14 of the 417 FOIA requests were completed within the 
statutory timeframe. Fifty-five of the requests took more than 500 days to process. The majority 
of the requests, 243 of 417, are still pending; several of these pending requests were received 
years ago. For example, 10 of the 23 pending requests relating to former Secretary of State Colin 
Powell are at least 5 years old. 

Table 1; Processing Time for FOIA Requests Related to Recent Secretaries of State 
Requests Completed Within Listed Times 

Up to 20 21-100 101-500 500+ Total Number of 


Secretary 

Days 

Days 

Days 

Days 

Still Pending 

FOIA Requests 

Albright 

1 

0 

2 

4 

2 

9 

Powell 

8 

4 

37 

27 

23 

99 

Rice 

1 

3 

7 

9 

20 

40 

Clinton 

3 

19 

27 

14 

177 

240 

Kerry 

1 

2 

4 

1 

21 

29 

Total 

14 

28 

77 

55 

243 

417 


Source: OIG analysis of IPS data, as of June 2015. 

In 2012, OIG reported that one of the key reasons for the timeliness problem was that a 
relatively small number of IPS staff were processing the heavy volume of Department- wide 
requests.^' Since then, as shown in Figure 2, FOIA requests have increased, yet the Department 
has allocated fewer employees to handle them. According to IPS, some of these employees have 
been assigned hundreds of requests each and face severe challenges in properly managing their 
caseloads. 


Figure 2: IPS Staff Devoted to Processing Department-wide FOIA Requests 


FOIA Requests Received 





S/ES told OIG that its statistics differ from IPS data, but agreed to work with IPS to reconcile the inconsistencies. The 
FOIA process has several steps, and IPS often tasks multiple offices with responding to requests. Thus, the delays 
noted in this chart could have occurred at multiple steps in the process and are not necessarily attributable to S/ES 
search delays. 

® OIG, Inspection of the Bureau of Administration, Global Information Services, Office of Information Programs and 
Services 0SP-I-12-54, September 2012). GAO also stressed the importance of redirecting or acquiring resources to 
dear backlogs in a 2012 report on FOIA compliance across the Government. See GAO, Freedom of Information Act: 
Additional Actions Can Strengthen Agency Efforts to Improve Management (GAO- 12-828, July 2012). 
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Furthermore, approximately one-third of IPS staff have been assigned to work on one FOIA case 
in litigation, Leopold v. Department of State, in which the court ordered a rolling production of 
the approximately 55,000 pages of former Secretary Clinton's emails that she provided to the 
Department in December 2014, while other FOIA work is understaffed.® 

In each of the past 3 years, IPS has attempted to address this issue by requesting additional 
personnel to meet the rising caseload, including its most recent request to the Bureau of 
Administration for 27 additional staff, which it estimated would result in a 10-percent reduction 
in the FOIA backlog. However, the Department has not provided any additional permanent 
personnel. 

In late September 2015, the Under Secretary for Management decided to detail staff already 
within the Department to IPS. However, little progress has been made to date to resolve the 
personnel shortage. On September 2, 2015, the Department solicited expressions of interest 
from current and retired Department employees in a 9 to 12 month detail to IPS. As of the 
beginning of November, 7 temporary employees had started work. 

S/ES Does Not Routinely Follow Requirements To Search Email 

As a general rule, an agency must undertake a FOIA search that is "reasonably calculated to 
uncover all relevant documents."® Since 1997, FOIA has specified that agencies must make a 
reasonable effort to search for requested documents in electronic form or format, except when 
such efforts would "significantly interfere" with the operation of an agency's information 
system.® In 2010, the Department issued more explicit requirements for FOIA compliance: 

Unless otherwise noted in a given request, offices should conduct a search for 
records in any form, including paper records, email (including email in personal 
folders and attachments to email), and other electronic records on servers, on 
workstations, or in Department databases,^* 

In addition to searching paper records, S/ES typically searches for relevant documents in several 
electronic databases, including classified files, the Department's cable and telegram systems, the 
Secretariat Tracking and Retrieval System (STARS), and EVEREST (which replaced STARS).® None 


® The Department anticipates completing the court-ordered production in January 2016. 

® Weisberg k US. Dep't of Justice, 705 F.2d 1344, 1351 (D.CCir. 1983). 

® 5 U.S.C. § 5S2(a)(3)(C)). 

FOIA Guidance For State Department Employees, at 8. 

® According to information provided by S/ES, EVEREST is a web-based application that provides the Secretary of 
State and other senior Department principals the ability to receive foreign policy memoranda and correspondence 
from Department bureaus and offices electronically, as well as task and track the paperless submission of most 
memoranda. Correspondence and memoranda can include internal and external letters, action memos, information 
memos, briefing checklists, and telephone talking points, as well as documents received from other agencies. 
Incoming documents are uploaded (in their native format) by originating offices into EVEREST, submitted to the 
Executive Secretary for review, and forwarded electronically to the relevant Department principal. EVEREST replaced 
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of these databases are intended to archive email files. STARS and EVEREST are systems used to 
route foreign policy memoranda and other documents to the Office of the Secretary, S/ES rarely 
searched electronic email accounts prior to 2011 and still does not consistently search these 
accounts, even when relevant records are likely to be uncovered through such a search. For 
example, S/ES has not searched email accounts for requests seeking all "correspondence" 
between the Secretary of State and another party. The FOIA Analyst described the decision to 
search email accounts to be a discretionary one that is only exercised periodically. 

According to the Deputy Director's explanation of current practices, S/ES initiates a search of 
email accounts only if a FOIA request mentions emails or explicitly refers to "all records.” S/ES 
will also search email if it is requested to do so by an L attorney during the course of litigation 
arising over FOIA issues. If a FOIA request specifically asks for emails of a current employee, the 
FOIA Analyst tasks S, D, P, or C with searching for the records but does not review the search 
methodology or approve the results. It appears that current S, D, P, and C employees search 
through their own email accounts for responsive records.’^ If the FOIA request specifically asks 
for emails of a former employee, the FOIA Analyst requests the applicable stored electronic file 
from the S/ES Office of Information Resources Management (S/ES-IRM), the office that handies 
information technology for the Office of the Secretary." S/ES-IRM reported to OIG that it has 
maintained files numbering in the thousands for selected senior officials" dating back at least as 
far as Secretary Powell's tenure, though OIG has determined that many of these are not easily 
accessible," Moreover, as the Deputy Director noted, searching these files is difficult because 
searches are limited to those that can be undertaken using Microsoft Outlook." 

FOIA neither authorizes nor requires agencies to search for Federal records in personal email 
accounts maintained on private servers or through commercial providers (for example, Gmail, 
Yahoo, and Hotmail)." Furthermore, the FOIA Analyst has no way to independently locate 
Federal records from such accounts unless employees take steps to preserve official emails in 


STARS on January 1, 2015, and serves as a permanent, searchable record for the Secretary of State and other senior 
Department principals memoranda. STARS is a legacy system that was designed to manage the flow of foreign policy 
memoranda and correspondence both to and from the Secretary of State and other senior Department principals. 
Incoming and outgoing documents were scanned into STARS, manually indexed (through use of a brief abstract 
summarizing the substance of the document and identifying document-specific key words), and stored as document 
images. Searches are limited to retrieval of materia! based on index terms attached to the document; the document 
images themselves cannot be searched using text-based search methods. New entries into STARS ended January 1, 
2015, but it continues to be used to locate and retrieve documents. 

OIG did not evaluate the practices used by S, D, P, and C. 

S/ES-IRM stores the files in Persona! Storage Table (.pst) files, a format used to store copies of email messages, 
calendar events, and other items within Microsoft software. 

S/ES-IRM does not maintain an index or Inventory of these files. 

In 2015, the Department began permanently retaining the emails of 102 senior officials. 

S/ES has begun testing software intended to enhance its ability to search and retrieve email records. 

Records subject to FOIA are those that are (1) either created or obtained by an agency and (2) under agency control 
at the time of the FOIA request ly.S. Dept, of Justice v. Tax Analysts. 492 U.5. 136 (1989). 5ee also Competitive Enter. 
Inst V. Office ofSci. and Tech. Policy, No. 14-765, 2015 WL 967549 {D.D.C. March 3, 2015), 
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Department recordkeeping systems. DIG will report separately on preservation requirements 
applicable to past and current Secretaries of State and the Department's efforts to recover 
Federal records from personal accounts. However, under current law and Department policy, 
employees who use personal email to conduct official business are required to forward or copy 
email from a persona! account to their respective Department accounts within 20 days.^'’ The 
Deputy Director, who has handled FOIA responsibilities for S/ES since 2006, could not recall any 
instances of emails from personal accounts being provided to him in response to a search 
tasked to an S/ES component.® 

PROCEDURAL WEAKNESSES CONTRIBUTE TO DEFICIENT FOIA 
SEARCHES AND RESPONSES 


Current S/ES FOIA Processes Are Inadequate 

Although specific details of processes for handling FOIA requests vary among agencies, the 
major steps in processing a request are similar across the Federal Government. Recent 
assessments of the Department's processes revealed poor practices. In 2012, OIG's inspection of 
A/GIS found, among other deficiencies, that FOIA requests are prone to delay and that IPS 
lacked a sound process to develop its information systems."* A 2015 report by the Center for 
Effective Government found that, among 15 agencies that receive a large volume of public 
records requests, the Department ranked last, in part because of increased processing times and 
outdated regulations."* According to the report, the Department was the only agency whose 
rules do not require staff to notify requesters when processing is delayed, even though this is 
mandated by law. Furthermore, little attention has been paid to the accuracy and completeness 
of responses to FOIA requests. The Department has not sent out a notice or memorandum 
reminding employees of their FOIA responsibilities since March 2009, when former Secretary 
Clinton sent a message commemorating Freedom of Information Day. 

Although OIG focused on procedural weaknesses in the Office of the Secretary for this 
evaluation, the issues OIG identified have broader implications. Standards for Interna! Control in 
the Federal Government stresses that the tone at the top — management's philosophy and 
operating style — is fundamental to an effective internal control system."* OIG's past and current 


*" 44 U.S.C. 2911; Department of State, A Message from Under Secretary for Management Patrick F. Kennedy 
regarding State Department Records Responsibilities and Policy, Announcement No. 2014„10_1 15, October 17, 2014. 
"* In November 2014, the Department sent a request to former Secretaries of State for any Federal records that were 
housed on personal email. In March 2015, the Department sent similar requests to severai staff members who worked 
for former Secretary Clinton. The Department has and continues to produce some of the records received from these 
requests in response to FOIA requests. 

"* OIG, Inspection of the Bureau of Administration, Global In formation Services, Office of Information Programs and 
Services (ISP-l-12-54, September 2012). 

Center for Effective Government, Making the Grade: Access to Information Scorecard 2015 {Uatdn 2015). 

"* GAO-14-704G, §S 1.02 to 1.05. 
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work demonstrates that Department leadership has not played a meaningful role in overseeing 
or reviewing the quality of FOIA responses. On September 8, 2015, Secretary Kerry announced 
the appointment of a new Transparency Coordinator, charged with improving document 
preservation and transparency systems* This is a positive step, but the following areas, in 
addition to the lack of compliance with legal and regulatory requirements, need immediate 
attention: 

Lack of Written Policies and Procedures. Although other Department components, such as the 
Bureaus of Diplomatic Security and International Narcotics and Law Enforcement Affairs, have 
their own written FOIA guidance or standard operating procedures, S/ES does not. S/ES does 
use guides on how to search its own databases, EVEREST and STARS, but these are not FOIA 
specific and no criteria for conducting database searches have been developed. The FOIA 
Analyst for S/ES reported learning how to perform a FOIA search from on-the-job training. 
Standards for Internai Contra! in the Federal Government emp'dasaes the importance of 
documenting policies and procedures to provide a reasonable assurance that activities comply 
with applicable laws and regulations."^ Written policies and procedures are also important for 
continuity because they increase the likelihood that, when organizational changes occur, 
institutional knowledge is shared with new staff."* Other agencies have recommended written 
policies and procedures as a best practice. For example, the Office of Inspector General for the 
Environmental Protection Agency recommends that all regional and program offices responsible 
for FOIA responses adopt written standard operating procedures to ensure quality control."’ The 
Office of Inspector General for the Department of Energy has made a similar recommendation, 
noting, "without formalized policy and procedures, it could be difficult for an individual 
unfamiliar with the process to take an active role in filling FOIA requests, possibly leading to 
delays dr ihefficiencies'in responding to requests.""* 

Inconsistent S/ES Monitoring Efforts: Standards for Interna! Control in the Federal Government 
also emphasizes the importance of ongoing monitoring that is built into an entity's operations. 
Other agencies' monitoring activities vary widely. At some agencies, senior attorneys or career 
members of the Senior Executive Service are responsible for approving FOIA responses: at 
others, administrative staff handle the entire FOIA search and review process."’ Nonetheless, 
standards emphasize that monitoring should include regular management and supervisory 


"" U.S. Department of State Press Statement Transparency Coordinator {SepX. 8 , 2015), available at 
http://www.state.gov/secretaty/remarks/2015/09/246691.htm. 

GAO-14-704G. 

See, e.g., GAO, S oda! Security Disability: Management Controls Needed to Strengthen Demonstration Projects 
(GAO-08-1053, September 2008). 

EPA, Office of Inspector General, EPA Has Improved Its Response to Freedom of Information Act Requests But 
Further Improvement Is Needed (09-P-0127, March 2009). 

DOE, Office of Inspector General, Department's Freedom of Information Act Request Process (OAS-SR-10-03, Sept 
2010 ). 

See, e.g., Nuclear Regulatory Commission, Office of Inspector General, Evaluation of Involvement of Political 
Appointees in NRCs FOIA Process tOlQ-lS-NU. August 2015) and Social Security Administration, Office of the 
Inspector General, Freedom of Information Act Response Process (A-03-15-50107, August 2015). 
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activities, comparisons, reconciliations, and other routine actions. Such actions may include 
assessing employee performance with FOIA compliance, conducting spot checks, and 
establishing and reviewing metrics. Performance standards within S/ES for handling FOIA 
matters are incomplete. In 2012, OIG recommended that the Department place responsibility at 
all stages of the process and update performance standards, position descriptions, and work 
commitments to reflect FOIA responsibilities." While the Deputy Director's performance 
standards have consistently contained multiple references to that individual's responsibilities as 
FOIA coordinator, the performance standards for the Deputy Director's former supervisors" in 
the Director of Secretariat Staff position have not mentioned FOIA at all. 

Other oversight activities have also been inconsistent. The Deputy Director reviews the FOIA 
Analyst's search and the records identified. However, the past two Directors of Secretariat Staff 
reported minimal involvement in the FOIA process, other than providing occasional briefings to 
supervisors on high-profile or sensitive requests. The past two Directors did not review actual 
FOIA searches and responses, even on a spot-check basis, for quality, timeliness, thoroughness, 
or consistency. They also did not gather or review any metrics or other tracking information on 
S/ES FOIA activities. The current Director, who has been in the position since July 2015, told OIG 
that, while she periodically reviews FOIA responses, depending on the scope and nature of the 
FOIA request, she does not carry out any spot checks for accuracy. The current Director also 
reviews status reports that contain basic information on the date of the request and the offices 
tasked with conducting searches. No one in S/ES reviews the methodology of FOIA searches 
tasked to the other components in the Office of the Secretary (S, D, P and C). 

Limited IPS Review CapabiHtytl^e FAM designates IPS as responsible for the Department's 
compliance with FOIA,^^ and Department guidance specifically requires IPS to ensure that 
responses are timely, accurate, and complete.” However, IPS is almost completely dependent on 
FOIA coordinators in individual bureaus and offices to ensure that search results meet FOIA 
requirements. IPS does not have the ability to do independent spot checks in part because it 
does not have access to the unique databases used to conduct the searches, such as the 
EVEREST system used by the Office of the Secretary. According to IPS, the quality of responses 
to requests for FOIA searches varies across the Department. For example, IPS reported that the 
form documenting the search result (Form DS-1748) the FOIA coordinators submit is sometimes 
missing key information, such as the files searched and the search terms used. If this information 
is missing or if IPS identifies another inconsistency, it may ask for a search to be redone. IPS 
reported that its reviewers have at times spent weeks working with FOIA coordinators to obtain 
complete responses. In some cases, IPS will contact the FOIA coordinator's supervisor or 
executive-level staff within the office to resolve an issue. IPS's engagement with S/ES has been 


“ GAO-14-704G, at §5 16.04, 16.05. 

The Department agreed with these recommendations but has yet to take action. 

" The performance standards for the current Director of Secretariat Staff were not yet available for review at the dose 
of OIG’s work. 

” 1 FAM 214.2. 

” U.S. Department of State, FOIA Guidance For State Department Employees QFilO). 
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limited, with its only contact typically being the Deputy Director. IPS also reports that it has 
contacted L attorneys for assistance when it has had difficulty obtaining complete responses 
from S/ES. In one case regarding a request for emails, correspondence, memos, internal notes, 
and other pertinent documents and records relating to a former S staff member, IPS tasked S/ES 
with a search in November 2013, but S/ES did not complete the search until December 2014 
after the involvement of L One L attorney characterized routine S/ES searches as frequently 
deficient, except in instances when FOIA litigation has commenced. 

Insufficient Training: Owmq OIG's 2012 inspection of A/GIS, IPS reported to DIG that most 
Department employees are poorly informed about FOIA principles and procedures, as well as 
about the importance of providing information to the public. IPS has since provided two 
Department-wide annual training courses on FOIA, recordkeeping, and classification issues. 
Records maintained by IPS show that no more than two S/ES employees have attended 
trainings, open houses, or workshops offered by IPS, and no one from S, D, P, or C has 
attended.^® In addition to the annual training sessions, IPS has trained specific offices on FOIA at 
their request. Twelve bureaus, offices, or embassies have requested and completed this training 
since 2014, but S/ES is not among them. 

S/ES FOIA Searches and Responses Are Sometimes Inaccurate and 
Incomplete 

These procedural weaknesses, coupled with the lack of oversight by leadership and failure to 
routinely search emails, appear to contribute to inaccurate and incomplete responses. 

L attorneys and officials in IPS recalled several instances when S/ES searches have yielded 
inaccurate or incomplete results, though they were unable to determine the magnitude of this 
problem. The attorneys also noted that FOIA requesters have been able to produce evidence of 
the existence of records responsive to a FOIA request despite the attestation by S/ES that no 
responsive records existed.® 

S/ES has not taken any corrective actions to ensure the accuracy and completeness of FOIA 
searches. Standards for Internal Control in the Federal Government notes that management 
should remediate identified deficiencies in controls and determine appropriate corrective 
actions on a timely basis.® Implementing such corrective actions could protect the Department 
from sanctions. For example, in litigated cases, incomplete searches by S/ES can expose the 
Department to financial liability, including attorney fees and other litigation costs.® The 
Department and its leadership could also be subject to contempt citations if they were found to 


® According to S/ES, the FOIA Analyst also attended workshops at the Department of Justice. 

® Department attorneys noted that these instances do not necessarily indicate that the search for records was 
inadequate. Not ail documents created by the Department are Federal records. It is also possible that a document 
existed at one time but was subsequently destroyed either in compliance with the records disposition schedules or 
because of poor recordkeeping practices. 

® GAO-14-704G, at §§ 17.01, 17.05. 

® 5 U.S.C. § S52(a)(4)(E). 
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have violated rules requiring candor to the court. Although L attorneys are not aware of an 
instance where such sanctions were imposed, it is not uncommon for courts to order the 
Department to conduct additional searches or provide additional information explaining the 
adequacy of the searches conducted.“ 

OIG has been unable to determine the extent of these inaccuracies, but recent examples of 
incomplete searches and responses to FOIA queries involving the Office of the Secretary include 
the following: 

• In March 2010, the Associated Press (AP) filed a FOIA request for copies of all of former 
Secretary Clinton's public and private calendars and schedules. IPS tasked S/ES with 
searching for responsive records. In November 2010, S/ES provided IPS with records that 
were non-responsive. IPS then contacted the Office of the Secretary directly and also 
contacted L for guidance. IPS has no record of receiving responses and the FOIA request 
sat dormant for several years. In August 2013, AP resubmitted its FOIA request and 
updated it to include a request for all of the calendars from Secretary Clinton's tenure. In 
June 2014, December 2014, and again in July 2015, S/ES provided IPS with information 
regarding the location of these records, which had been retired. In March 2015, after 
failing to receive responses to multiple FOIA requests, AP filed suit against the 
Department." In a July 2015 court filing, the Department disclosed that it had finally 
conducted a search and located at least 4,440 paper and electronic records related to 
Secretary Clinton's calendars and schedules, which were created by various personnel in 
the Office of the Secretary. 

• In December 2012, the nonprofit organization Citizens for Responsibility and Ethics in 
Washington (CREW) sent a FOIA request to the Department seeking records "sufficient 
to show the number of email accounts of, or associated with. Secretary Hillary Rodham 
Clinton, and the extent to which those email accounts are identifiable as those of or 
associated with Secretary Clinton."^ On May 10, 2013, IPS replied to CREW, stating that 
"no records responsive to your request were located."®^ At the time the request was 


See, e.g., Judicial Watch v. Interna! Revenue Service, Civil Action No. 13-1559 (D.D.C.), \where contempt of court 
citations have been threatened against the IRS in a FOIA lawsuit. 

^ See e.g., Tarzia v. Clinton, Civil Action No. l:10-cv-05654-FM (S.D.N.Y. January 30, 2012); Beltranena v. Clinton, Civil 
Action No. l:09-cv-01457-BJR (D.D.C. March 17, 2011). 

The Associated Press v. U.S Dept of State, Civil Action No. l:15-cv-00345-RJL (D.D.C). 

" Later in the letter as part of its request to waive processing fees, CREW stated its belief that the records it was 
requesting were "iikely to contribute to greater public awareness of the extent to which Secretary Clinton, like the 
administrator of the Environmental Protection Agency (EPA), use[sl email accounts not readily identifiable as her 
accounts." CREW also noted: "[r]ecently it was reported that [EPAJ Administrator Jackson established alias email 
accounts to conduct official government business, including an account under the name 'Richard Windson' which is 
not publicly attributable to her. . . Through this FOIA, CREW seeks to learn how widespread this practice is, and to 
evaluate the extent to which it has led to under-inclusive responses to FOIA, discovery, and congressional requests, 
and a failure to preserve records in a way that complies with the Federal Records Act" 

" The response also noted; 
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received, dozens of senior officials throughout the Department, including members of 
Secretary Clinton's immediate staff, exchanged emails with the Secretary using the 
personal accounts she used to conduct official business. OIG found evidence that the 
Secretary's then-Chief of Staff was informed of the request at the time it was received 
and subsequently tasked staff to follow up. However, OIG found no evidence to indicate 
that any of these senior officials reviewed the search results or approved the response to 
CREW. OIG also found no evidence that the S/ES, L, and IPS staff involved in responding 
to requests for information, searching for records, or drafting the response had 
knowledge of the Secretary's email usage. “ Furthermore, it does not appear that S/ES 
searched any email records, even though the request clearly encompassed emails. 

• In May 2013, the nonprofit organization Judicial Watch filed a FOIA request for records 
related to the authorization of a former adviser to Secretary Clinton to undertake 
employment outside the Department. IPS tasked S/ES with performing the search, which 
returned 23 documents. In August 2013, AP filed a FOIA request seeking the same 
information, but S/ES only returned five documents for a nearly identical request, 

• In May 2014, Judicial Watch filed a FOIA request seeking records related to talking points 
given to Ambassador to the United Nations Susan Rice concerning the September 11, 
2012, attack on the U.S. diplomatic facilities in Benghazi, Libya. In July 2014, Judicial 
Watch filed suit in district court because the Department had not responded to the 
request. In September 2014, IPS tasked S/ES with conducting the search. S/ES initially 
identified five documents but only returned four documents to IPS because it did not 
view the fifth document, an email, as responsive. IPS provided the four documents to 
Judicial Watch in November 2014. In June 2015, pursuant to an earlier request, several 
former officials provided the Department with copies of records that were in their 
possession. One of these records included the fifth document identified in the 
September 2014 search by S/ES as part of a longer email chain, S/ES reviewed this 


It may be helpful for you to know that messages from the Secretary are occasionally transmitted to the 
Department via email. However, these messages are transmitted from a "dummy" email address that is not 
capable of receiving replies, rather than from a functioning email account. 

On August 11, 2014, the Department produced to the House Select Committee on Benghazi documents related to 
the 2012 attack on U.S. facilities in Benghazi. The production included a number of emails revealing that Secretary 
Clinton used a personal email account to conduct official business. OIG discovered four instances, between July and 
September 2014, in which staff from L, A, or the Bureau of Legislative Affairs reviewed the CREW request and the 
Department's May 2013 response, but the Department did not amend its response. L and A staff also told OIG that 
the Department does not customarily revise responses to closed FOIA requests. Nevertheless, during the course of 
this review, Department staff advised OIG of their belief that the Department's response to CREW was incorrect and 
that it should have been revised to include the former Secretary's personal email account used to conduct official 
government business. OIG notes that the issue may have been resolved insofar as the Department Is now engaged in 
the process of publishing on its FOIA website the 55,000 pages of personal emails produced by Secretary Clinton. 

According to a February 26, 2013, memorandum to IPS. S/ES stated that its FOIA Analyst spent an hour searching 
through the Department cable and telegram system and STARS and did not discover any responsive records. The 
Deputy Director reviewed the search and results, but no other official within S/ES conducted a review. 
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document and determined that it was in fact responsive to the FOIA request, which the 
Department disclosed to the court in July 2015. 


RECOMMENDATIONS 


To ensure that FOIA requests involving the Office of the Secretary generate timely, accurate, and 
complete searches and responses, OIG has issued the following recommendations to the Bureau 
of Administration, the Office of the Secretary, and the Department's Transparency Coordinator. 
Their responses can be found in Appendix A. 

Recommendation 1: The Bureau of Administration should identify necessary permanent 
personnel as part of FOIA workforce planning efforts and quickly acquire those resources so the 
Department can comply with applicable law and improve the timeliness of FOIA searches and 
responses. 

Management Response: In its November 30, 2015, response, the Bureau of Administration 
concurred with this recommendation. It noted that its fiscal year 2017 budget request includes 
funding for two additional permanent positions for FOIA and continued funding of 50 
temporary positions (eligible family members and rehired annuitants). 

OIG Reply; OIG considers the recommendation resolved. The recommendation can be closed 
when OIG receives and accepts documentation showing that these 52 positions have been filled. 
However, OIG strongly encourages the Bureau of Administration to continue to monitor its 
staffing levels to determine whether additional permanent personnel are needed to process 
FOIA requests. 

Recommendation 2: The Office of the Secretary, Executive Secretariat, should fully comply with 
FOIA requirements and Department guidance by (a) searching email records for all FOIA 
requests in which relevant records are likely maintained in email accounts; and (b) reminding 
S/ES employees that Federal records contained in personal emails may be subject to FOIA when 
in the Department's control and should be preserved in the Department's recordkeeping 
systems. 

Management Response: In its November 30, 2015, response, the Executive Secretariat concurred 
with this recommendation. It noted that its current practice is to search email records for all 
FOIA requests in which responsive records are likely to be located. 

OIG Reply; OIG considers the recommendation resolved. This recommendation can be closed 
when OIG receives a copy of S/ES FOIA policies and procedures that require a search of email 
records for all FOIA requests in which relevant records are likely maintained in email accounts 
and a reminder to S/ES employees that Federal records contained in personal email may be 
subject to FOIA and must be preserved in the Department's recordkeeping systems. 
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Recommendation 3: The Office of the Secretary, Executive Secretariat should address 
weaknesses in its FOIA processes by: 

• Developing written policies and procedures for performing FOIA searches addressed to 
the Office of the Secretary, 

• Including FOIA duties as part of the performance standards for the Director of Secretariat 
Staff. 

• Ensuring that executive-level staff members rigorously oversee the FOIA process, to 
include regular monitoring activities and implementing corrective actions as needed. 

• Coordinating FOIA training for all S/ES, Office of the Secretary, Deputy Secretaries, Under 
Secretary for Political Affairs, and Counselor of the Department staff. 

Management Response: In its November 30, 2015, response, the Executive Secretariat concurred 
with this recommendation. It noted that S/ES is currently drafting FOIA policies and procedures 
and metrics for timeliness and completeness of FOIA responses, S/ES also noted that the work 
requirements for the current Director of the Executive Secretariat include FOIA responsibilities 
and that FOIA training for S/ES staff is in progress. 

OIG Reply; OIG considers the recommendation resolved. This recommendation can be closed 
when OIG receives copies of S/ES FOIA policies and procedures that include monitoring 
activities and the development of metrics that are reviewed by executive-level staff; a copy of 
the work requirements for the current Director that include FOIA responsibilities; and FOIA 
training records for S/ES employees. 

Recommendation 4; The Department's Transparency Coordinator should work with IPS to 
develop a quality assurance plan to identify and address Department-wide vulnerabilities in the 
FOIA process, including lack of monitoring of FOIA searches and responses, technological 
challenges, and the sufficiency of staffing and training. 

Management Response: In her response, the Transparency Coordinator concurred with this 
recommendation. She endorsed an accountability framework for the Department that includes 
processes, roles, standards, and metrics to help ensure that important legal, administrative, 
evidential, and historical information requirements of the Department are met. 

OIG Reply: OIG considers the recommendation resolved. This recommendation can be closed 
when 016 receives a copy of the quality assurance plan. 
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APPENDIX A: MANAGEMENT RESPONSES 




I nited States Department nf Slate 

Assis-femt Stcremrx of Suae 
for 

Washinpon. TAC. 2.0520 

November 30, 20 i 5 


UNCLASSIFIED 


TO; 

FROM: 


Inspector General - Steve Linick 
Bureau of Administration - Joyce A. Barr 



SUBJECT: Draft report - Review of the Department of State’s FOIA 

Processes for Requests Involving the Office of the Secretary' 
{ESP-16-01 dated November 13, 2015) 


The Bureau of Administration thanks the OIG for the opportunity to respond to the 
subject draft report and provides the following in response to the single 
recommendation for this bureau's action. 


Recommendation 1: The Bureau of Administration should identify necessary 
permanent personnel as part of the FOIA workforce planning efforts and quickly 
acquire diose resources so the Department can comply with applicable law and 
improve the timeliness of FOLA searches and responses. 


The Bureau of Administration concurs with this recommendation. As the OIG is 
aware, increasing the number of A/GIS/IPS FOIA staff is one part of the solution 
for improving Department response time to FOIA cases that are often broad and 
extremely complex. To date, A Bureau has taken the following steps to increase 
our FOIA staftlng/resources in Fiscal Year 2016 and our request for Fiscal Year 
2017. 

The A/GIS approved budget request for FY 2016, which includes FOIA, was 
$13,932,000. The A Bureau recently requested an additional $8.3M for FY 2016 to 
cover the cost of salaries, support, information technology (IT), and other 
necessities for 50 new positions dedicated to FOIA operations (“FOIA 
50"). Hiring is currently under way for 10 Eligible Family Members (EFMs) and 
40 subject matter expert Foreign Service annuitants. A minimum Top Secret 

UNCLASSIFIED 
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clearance is required for each of these positions and hiring eligible family members 
and annuitants helps to expedite that clearance requirement. The FY 2016 fimding 
level for these activities is subject to the availability of FY 20 1 6 appropriations 
which are currently pending with Congress. 

A Bureau’s FY 20 1 7 request to OMB includes two FTE and additional support 
costs including resources to improve FOIA systems. It is our understanding the 
OMB pass-back for FY 2017 is expected later this week. If provided, the 
resources requested for FY 2017 should allow the A Bureau to fund, at least 
partially, the recurring costs to maintain the FOIA 50 positions in FY 2017 (i.e. 
salaries, support, IT, etc.). 

The A Bureau appreciates the OIG’s support of our ongoing efforts to improve the 
Department’s FOIA program. 


UNCLASSIFIED 
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United States Department of State 

Washington, D.C. 20520 
November 30, 2015 


TO: 

FROM: 


Steve Linick, Inspector General 
MaryKary Carlson, Act'mg Executive Secret 




SUBJECT: Response to Draft OIG Review of the Department of State’s 

FOI A Processes for Requests Involving the Office of the 
Secretary 


The Executive Secretariat thanks the OIG for the opportunity to respond to this 
review and values the OIG’s study of the Department’s FOIA process. The 
Secretariat has the following specific responses to the recommendations contained 
in the report. 

Recommendation 1: While this recommendation is directed to the A Bureau, the 
Executive Secretariat notes that it has experienced a commensurate increase in the 
number of FOIA requests and also needs more Stas' dedicated to FOIA-related 
work. S/ES-S is currently in the process of reprogramming one FTE position to 
work on FOIA. While the growing FOIA workload has affected response times, 
S/ES-S records do not match the number of pending FOIA requests cited in the 
draft report. S/ES-S and A/GIS/IPS have agreed to work together to review and 
reconcile the number of outstanding FOIA cases involving theOfficeofthe 
Secretary. 

Recommendation 2: The Executive Secretariat stror^ly agrees with the OIG 
recommendation that it should fully comply with FOIA requirements and 
Department guidance by searching email records for all FOIA requests in which 
relevant records are likely maintained in email accounts. This is the current 
practice of the Executive Secretariat staff (S/ES-S) and is the instruction provided 
to all offices engaged in FOIA searches involving the Office of the Secretary and 
comports with the instruction provided to all offices in the Department. 

The Executive Secretariat further agrees with the OIG recommendation that S/ES 
employees should be reminded that Federal records contained in personal emails 
may be subject to FOIA and should be preserved in the Department’s record- 
keeping systems. All Department employees received this guidance and 
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instruction from the Under Secretary for Management on October 1 7, 2014 and it 
is reiterated to all S/ES and S burcau employees in their check-in, periodic training, 
and check-out briefings on records management. As instructed in the above- 
referenced guidance from tiie Under Secretary for Management, to ensure Federal 
records contained in personal emails are preserved in the Department’s 
recordkeeping systems, all employees are required to copy or forward any personal 
message containing a Federal record to tiieir official Department email accounts 
for appropriate retention and archiving. 

Recommendation 3; The Executive Secretariat welcomes the OlG's suggestions 
for improvement in its FOIA processes and concurs with all four cIcmcnLs of the 
recommendation. The Executive Secretariat has already taken steps to implement 
these recommendations, specifically: 

1 . Written policies and procedures (SOPs) are currently being drafted for ail 
involved in the FOIA search process in the S bureau. These SOPs will be 
cleared witli A/GISAPS and others in the Department, as appropriate. 

2. The work requirements of the current Director of the Executive Secretariat 
StafT(S/ES-S) include oversieht and management of the FOIA process for 
S/ES. 

3. The Director of the Executive Secretariat StatY oversees ail FOIA searches 
conducted by S/ES-S staff and reviews and approves all responses to A 
Bureau. S/ES-S management is developing metrics for timeliness of 
response and completeness of searches. 

4. The Acting Executive Secretary and other senior E-xccutive Secretariat 
managers have recently completed FOIA training conducted by A/GIS, and 
training sessions are being arranged for staff of the oHlce ofthe Secretary, 
the Deputy Secretaries, the Under Secretary for Political Affairs, and the 
Counselor. 

The Secretariat notes (p. 9 of draft report) the OKi comment on the fact that S/ES 
tasks current S, D, D-MR, P. and C employees to search through their own email 
accounts for responsive records in FOIA cases. The Executive Secretariat would 
like to clarify for OIG that this is standard practice Department-wide per guidance 
from A Bureau. The Executive Secretariat would further like to clarify OIG 
that S/ES-S does review the results of all such searches. 

Recommendation 4: The Executive Secretariat looks forward to continuing 
ongoing collaboration with the Transparency Coordinator to improve the FOIA 
process. In particular, the Secretariat strongly supports the recommendation to 
focus on technological challenges to conducting successful FOI.A searches. 

UNCLASSIFIE D 
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TO: Steve Linick, Inspector General 

FROM : Janice L. Jail^s, Transparency Coordinator 

SUBJECT: Response to Draft OIG Review of the Department of State’s 

FOIA Processes for Requests Involving the Office of the 
Secretary 

I appreciate the work by your Special Projects team to identify needed 
improvements to processes and procedures related to the Department’s handling of 
requests under the Freedom of Information Act (FOIA). I will take the opportunity 
in the Quality Assurance Plan (QAP) to address FOIA-related issues 
(Recommendation 4) within the context of information management within the 
Department. 

As Transparency Coordinator, my overall vision is a century enterprise-wide 
information management system that advances the Department’s goals of increased 
efficiency, transparency, and accountability. Under this vision, records 
management is less an independent atm in the information landscape and a more 
integrated process and functional system within a whole-of-enterprise information 
and knowledge management environment. 

Information is one of the Department’s most valuable assets requiring careful 
management, thoughtful governance and strategic consideration in its use and 
control. The IG report recommends a stronger focus on information governance, 
technological challenges and sufficient staffing and training. Specifically, the 
Department needs an accountability framework that covers the processes, roles, 
standards, and metrics to help ensure that important legal, administrative, 
evidential and historical information requirements of the Department are met. 
Creating this framework is the goal of the QAP I will prepare, in concert with 
A/GIS/IPS, S/ES and other pertinent offices. 

The Department is not alone in dealing with the information management 
challenges associated with today’s fast changing, data-driven world. Many 
agencies have the same issues: records management/FOlA traditionally have not 
been a high priority; a new norm of a high volume of requests and litigation cases; 
staffing and funding shortfalls; outdated technology or technology silos; 
insufficient records-related internal controls; and insufficient training/education on 
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the importance of effective management of information/records. Secretary Kerry 
recognizes these challenges and my appointment was one step towards trying to 
address these matters holistically. 

My plan will address all these issues, again with a view towards finding 
Department-wide solutions. I will start with a communications strategy that begins 
to talk about information management in new ways to highlight the important role 
that all Department employees play in preserving records. This wll begin widi a 
message from the top followed up by periodic messages to domestic and overseas 
employees. 

Thank you for the opportunity to provide comments to the report on FOI A-related 
processes. I look forward to helping to implement your recommendations both on 
FOIA and on records preservation in general. 
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OBJECTIVES AND METHODOLOGY 


In April 2015, the Office of Inspector General (OIG) initiated an evaluation to address concerns 
identified during recent audits and inspections^ and to respond to requests from the current 
Secretary of State and several Members of Congress involving a variety of issues, including the 
use of non-Departmental systems^ to conduct official business, records preservation 
requirements, and Freedom of Information Act (FOIA) compliance. This report, which is the 
fourth and final to document OIG's findings in these areas, ^ addresses efforts undertaken by the 
Department of State (Department) to preserve and secure electronic records and 
communications involving the Office of the Secretary. Specifically, this report (1) provides an 
overview of laws, regulations, and policies related to the management of email records; (2) 
assesses the effectiveness of electronic records management practices involving the Office of 
the Secretary: (3) evaluates staff compliance with records management requirements; and (4) 
examines information security requirements related to the use of non-Departmental systems. 

As part of the current evaluation, OIG reviewed laws, policies, and practices from (and, in some 
cases, prior to) 1997 through the present, covering the tenures of five Secretaries; Madeleine 
Albright (January 23, 1997-January 20, 2001); Colin Powell (January 20, 2001-January 26, 2005); 
Condoleezza Rice (January 26, 2005-January 20, 2009); Hillary Clinton (January 21, 2009- 
February 1, 2013); and John Kerry (February 1, 2013-Present). 

OIG reviewed the requirements of the Federal Records Act'' and the Federal Information Security 
Management Act (FISMA)® and related regulations; circulars and directives issued by the 
President, the National Archives and Records Administration (NARA), the National Institute of 
Standards and Technology (NIST), and the Office of Management and Budget (0MB); applicable 


^ OIG has identified the following issues: inconsistencies across the Department in identifying and preserving records, 
hacking incidents and other issues affecting the security of Department electronic communication, delays and other 
processing problems related to FOIA requests, and concerns about an Ambassador's use of private email to conduct 
official business. See OIG, Review of State Messaging and Archive Retrieval Toolset and Record Email {ISP-I-15-15, 
March 2015); OIG, Audit of the Department of State Information Security Program (AUD-IT-15-17, October 2014); 
OIG, Management Alert: OIG Findings of Significant and Recurring Weaknesses in the Department of State 
Information System Security Program {AUD-IT-14-03, November 2013); OIG, Inspection of the Bureau of 
Administration Globa! information Services, Office of Information Programs and Services (ISP-I-12-54, September 
2012); and OIG, Inspection of Embassy Nairobi Kenya (I5P-I-12-38A, August 2012). 

^ For purposes of this work, OIG uses the term "non-Departmental systems' to mean hardware and software that is 
not owned, provided, monitored, or certified by the Department of State. 

’ Previous reports include the following: OIG, Potential Issues Identified by the Office of the Inspector Genera! of the 
Intelligence Community Concerning the Department of State’s Process for the Review of Former Secretary Clinton ‘s 
Emails under the Freedom of Information 4cf (ESP-15-04, July 2015), OIG, Evaluation of the Department of State's 
FOIA Processes for Requests Involving the Office of the Secretary January 2016), and OIG, Classified 

Material Discovered in Unclassified Archival Material {ESP- 16-02, March 2016). 

^ 44 U.S.C. chapters 21, 29, 31, and 33. 

^ Pub. L. No. 107-347, title III, 116 Stat. 2946 (2002). In 2014, RSMA was replaced by the Federal Information Security 
Modernization Act, 44 U.S.C. § 3551 (2014). 
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Department directives issued in the Foreign Affairs Manual (FAM) and the Foreign Affairs 
Handbook and guidance and policies in cables and memoranda. Appendix A summarizes 

the relevant laws and policies that OIG reviewed during this evaluation, 

OIG employed a number of strategies to test compliance with email records preservation 
requirements applicable to each Secretary's tenure, including (1) sending questionnaires to 
current and former staff of the Office of the Secretary requesting information about email usage 
and preservation practices; (2) reviewing records and public statements related to email usage; 
(3) comparing stated practices against applicable laws and policies; and (4) searching available 
hard-copy and electronic files to identify and analyze email records and assess staff practices. 
OIG faced a number of challenges in conducting this testing, which will be discussed in greater 
detail throughout the report. 

OIG also interviewed dozens of former and current Department employees, including the 
Deputy Secretary for Management and Resources (D-MR); the Under Secretary for Management 
(M); the Assistant Secretary and other staff in the Bureau of Administration (A); and various staff 
in the Office of the Secretary and its Executive Secretariat (S/ES), the Office of the Legal Adviser 
(L), the Bureau of Information Resource Management (IRM), and the Bureau of Diplomatic 
Security (DS). In conjunction with the interviews, OIG reviewed paper and electronic records and 
documents associated with these offices. OIG also consulted with NARA officials. Finally, OIG 
interviewed Secretary Kerry and former Secretaries Albright, Powell, and Rice. Through her 
counsel. Secretary Clinton declined OIG's request for an interview. ’’ 

OIG conducted this work in accordance with quality standards for evaluations as set forth by the 
Council of the Inspectors General on Integrity and Efficiency. 

BACKGROUND 


The Federal Records Act requires the head of each agency to "make and preserve records 
containing adequate and proper documentation of the organization, functions, policies, 
decisions, procedures, and essential transactions of the agency and designed to furnish the 


^ The Department articulates official guidance, Including procedures and policies, on matters relating to Department 
management and personnel in the Foreign Affairs Manual and Handbook. 2 FAM 1111.1 (July 3, 2013). 

^ In addition to Secretary Clinton, eight former Department employees declined OIG requests for interviews: (1) the 
Chief of Staff to Secretary Powell (2002-05); (2) the Counselor and Chief of Staff to Secretary Clinton (2009-13); (3) the 
Deputy Chief of Staff for Policy to Secretary Clinton (2CK)9-11) and the Director of Policy Planning (2011-13); (4) the 
Deputy Chief of Staff for Operations to Secretary Clinton (2009-13); (5) the Deputy Assistant Secretary for Strategic 
Communication (2009-13); (6) the Director of the S/ES Office of Information Resources Management (2008-13); (7) a 
Special Advisor to the Deputy Chief Information Officer (2009-13) who provided technical support for Secretary 
Clinton's personal email system; and (8) a Senior Advisor to the Department who supervised responses to 
Congressional inquiries (2014-15). Two additional individuals did not respond to OIG interview requests: the Deputy 
Secretary of State for Management and Resources (2011-13) and an individual based in New York who provided 
technical support for Secretary Clinton's personal email system but who was never employed by the Department 
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information necessary to protect the legal and financial rights of the Government and of persons 
directly affected by the agency's activities."® Effective records management is critical for 
ensuring that sufficient documentation of an agency's business is created, that an agency can 
efficiently locate and retrieve records needed in the daily performance of its mission, and that 
records of historical significance are identified, preserved, and made available to the public.'* 

Citing its responsibilities under the Federal Records Act, the Department sent letters in October 
and November 2014 to the representatives of former Secretaries Albright, Powell, Rice, and 
Clinton requesting that they make available copies of any Federal records in their possession, 
such as emails sent or received on a personal email account while serving as Secretary of State. 

In response. Secretary Albright's representative advised that Secretary Albright did not use a 
Department or personal email account during her tenure, and Secretary Rice's representative 
advised that Secretary Rice did not use a personal email account to conduct official business.™ 
Representatives for Secretaries Powell and Clinton acknowledged that the Secretaries used 
personal email accounts to conduct official business. 

Secretary Powell has publicly stated that, during his tenure as Secretary, he "installed a laptop 
computer on a private line" and that he used the laptop to send emails via his personal email 
account to his "principal assistants, individual ambassadors, and foreign minister colleagues."” 
Secretary Powell's representative advised the Department in 2015 that he did not retain those 
emails or make printed copies.” Secretary Powell has also publicly stated that he generally sent 
emails to his staff via their State Department email addresses but that he personally does not 
know whether the Department captured those emails on its servers.” 

Secretary Clinton employed a personal email system to conduct business during her tenure in 
the United States Senate and her 2008 Presidential campaign. She continued to use personal 
email throughout her term as Secretary, relying on an account maintained on a private server, 
predominantly through mobile devices. Throughout Secretary Clinton's tenure, the server was 
located in her New York residence.™ 


® 44 U.S.C. § 3101. The FAW assigns these recordkeeping responsibilities to officials within the Bureau of 
Administration. 1 FAM 214 (May 1, 2009); 1 FAM 214.2 (November 25, 1998); 1 FAM 216.4 (January 17, 1997}. 

® GAO, Nstiona! Archives and Records Administration: Oversight and Management Improvements Initiated, but More 
Action Needed {GkO~ll~lS, October 5, 2010). 

Letter from Margaret P. Grafeld, Deputy Assistant Secretary for Global Information Systems, Bureau of 
Administration, U.S. Department of State, to Paul M. Wester, Jr., Chief Records Officer for the U.S. Government, NARA 
(April 2, 2015) [hereinafter Grafeld Letter). 

** Colin Powell, It Worked For Me: In Life and Leadership 109 (2012). 

” Grafeld Letter. Secretary Powell did not provide his emails to the Department in any form. 

” ABC News, This Week Transcript: Former Secretary of State Cotin Powett {tAa:ch 5, 2015), available at 
http://abcnews.go.com/PoHtics/week-transcript-secretary-state-colin-powell/story?id=29463658. 

“ A March 17, 2009 memorandum prepared fay S/ES-IRM staff regarding communications equipment in the 
Secretary's New York residence identified a server located in the basement. 
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In December 2014, in response to Department requests. Secretary Clinton produced to the 
Department from her personal email account approximately 55,000 hard-copy pages, 
representing approximately 30,000 emails that she believed related to official business. In a 
letter to the Department, her representative stated that it was the Secretary's practice to email 
Department officials at their government email accounts on matters pertaining to the conduct 
of government business. Accordingly, the representative asserted, to the extent that the 
Department retained records of government email accounts, the Department already had 
records of the Secretary's email preserved within its recordkeeping systems,’^ 

PRESERVATION REQUIREMENTS HAVE GENERALLY REMAINED 
CONSISTENT AS LAWS AND POLICIES RELATED TO THE USE OF 
EMAILS HAVE EVOLVED 


The requirement to manage and preserve emails containing Federal records has remained 
consistent since at least 1995, though specific policies and guidance related to retention 
methods have evolved over time. In general, the Federal Records Act requires appropriate 
management, including preservation, of records containing adequate and proper documentation of 
the "organization, functions, policies, decisions, procedures, and essential transactions of the 
agency."^ Although emails were not explicitly mentioned in the Federal Records Act or FAM until 
the mid-1990s, the law has stated since 1943 that a document can constitute a record "regardless of 
physical form or characteristics,"^’ 

NARA promulgates regulations providing guidance to agencies on implementation of the Federal 
Records Act and recordkeeping obligations more generally. Since 1990, the regulations issued by 
NARA have explained that the medium of the record may be "paper, film, disk, or other physical type 
or form" and that the method of recording may be "manual, mechanical, photographic, electronic, or 
any other combination of these or other technologies." These regulations also have stated that a 
record can be made "by agency personnel in the course of their official duties, regardless of the 
method(s) or the medium involved."’” See Appendix A for a compilation of preservation laws 
and policies that were in effect during the tenures of each Secretary, from Secretary Albright 
through Secretary Kerry. Figure 1 shows the evolution of management and preservation 
requirements related to emails containing Federal records. 


Letter from Cheryl Mills, cdmills Group, to Patrick F. Kennedy, Under Secretary of State for Management (December 
5, 2014). 

44 U.S.C § 3101, 

" H.R. 2943, Records Disposal Act of 1943, 57 Stat 380 {July 7, 1943), 

“ 44 U.S.C § 2904. 

36 CF.R. § 1222.12(b)(2) (1990). 

“ 36 C.F.R. § 1222.12(b)(3) (1990). 
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Figure 1: Timeline of Selected Records Management Requirements and Policies 


Federal Records Act requires mangement 
of records documenting an agency's. 

• organt?ation 

• functions 

• policies 

• decisions 

• procedures 

• essential transactions 
Requirement includes safeguarding against 
removal or loss of records 


CFR amended to confirm that an 
email may be a record and agencies using 
external email systems must take steps to ensure 
Uiese emails are preserved. 

FAM amended to require tfiat email records, 
including external ones, must be preserved in the 
Department's custody and that departing 
employees must certify surrender of all official 
documents. 


1997 

S/ES memo to ail Assistant Secretaries states that 
emails may be Federal records, in which case they 
should be printed and filed. 


200S-2009 Condofeezza Rice 


NARA bulletin requires that records must remain in 
custody of agencies and employees must ensure 
that they are incorporated Into recordkeeping ^ 
systems, especially those generated on personal 
computers. 


2001-2005 Colin Powell 


2004 

S/ES memo reminds departing officials to 
incorporate alt record material into tlie 
Department's files and not to remove any 
documentary materials — personal or official, 
written or electronic— until such materials have 
been reviewed by records and security officers 


2009-2013 Hillary Clinton 


2013 

NARA authorizes role based automatic preservation 
of emails. 


CFR provision added: "Agencies that allow 

employees to send and receive official electronic: 
mail messages using a system not operated by the 
agency must ensure that Federal records sent or 
received on such systems are preserved in the 
appropriate agency recordkeeping system.' 


Federal Records Act amended to explicitly include 
electronic records and to prohibit employees from 
u.sing personal email for official business unless 
they copy their official email or forward to their 
official email within ^0 days. 

Department directs employees generally not to 
use personal email accounts fnr official business; 
but if necessary to do so, employees must forward 
such emails to their State account 


2012 

^ OM8 and NARA require agencies to manatje 
M email records electronically, instead of by print 
iLI and file, by December 2016. 


2015 

Department begins automatically preserving emails 
of senior officials. 


Source; OIG analysis of laws and policies. 
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Email Records Equivalent to Other Records; In 1995, NARA amended the Code of Federal 
Regulations to confirm that "messages created or received on electronic mail systems may meet 
the definition of record.”^* The regulations also referenced the use of electronic communications 
systems external to the Government, indicating that "agencies with access to external electronic 
mail systems shall ensure that Federal records sent or received on these systems are preserved 
in the appropriate recordkeeping system."^ A recordkeeping system is a manual or electronic 
system that captures, organizes, and categorizes records to facilitate their preservation, retrieval, 
use, and disposition?^ The FAM adopted similar requirements in 1995, by providing in pertinent 
part that: 

all employees must be aware that some of the variety of the messages being exchanged 
on email are important to the Department and must be preserved; such messages are 
considered Federal records under the law?'* 

The FAM also included examples of emails that could constitute Federal records, including those 
providing key substantive comments on a draft action memorandum, documenting significant 
Department decisions and commitments reached orally, and conveying information of value on 
important Department activities?^ The Department has frequently reminded employees of this 
requirement, including through a November 2009 announcement to all employees that noted 
that Federal records can be found in "any media, including email, instant messages, social 
media, etc.''“ However, the Department believes that the majority of the millions of emails sent 
to and from Department employees each year are non-permanent records with no long-term 
value. 

In 2014, Congress amended the Federal Records Act explicitly to define Federal records to 
include "information created, manipulated, communicated, or stored in digital or electronic 
form."^^ 

Methods of Preservation: According to NARA regulations, an agency "must ensure that 
procedures, directives and other issuances ... include recordkeeping requirements for records in 
all media, including those records created or received on electronic mail systems."^ These 
recordkeeping requirements include identifying specific categories of records to be maintained 


36 C.F.R. 1 1222.34(e) (1995). 

36 C.F.R. § 1222.24(a)(4) (1995). 

36 C.F.R. § 1220.18 (2009). 

5 FAM 443.1(c) (October 30, 1995). 

“ 5 FAM 443.2(d) (October 30, 1995). 

“ See, e.g., 09 STATE 120561: Department of State, Records Management Responsibilities, Announcement No. 
2009JL125, November 23, 2009. 

Presidential and Federal Records Act Amendments of 2014, Pub. L, No: 113-187, 128 Stat. 2003 (November 26, 
2014) (amending 44 U.S.C. § 3301(a)). 

36 C.F.R. § 1222.24 (October 2, 2009). 
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by agency personnel. Such maintenance includes ensuring that complete records are filed or 
otherwise identified and preserved, records can be readily found when needed, and permanent 
and temporary records are physically segregated from each other (or, for electronic records, 
segregable). Guidance issued by both NARA and the Department emphasize that every 
employee has records management responsibilities and must make and preserve records 
according to the law and Department policy.® 

At the Department, compliance with this regulation and preservation of emails that constitute 
Federal records can be accomplished in one of three ways: print and file; incorporation into the 
State Messaging and Archive Retrieval Toolset (SMART); or the use of the NARA-approved 
Capstone program for capturing the emails of designated senior officials. Since 1995, the FAM 
has instructed employees, "until technology allowing archival capabilities for long-term 
electronic storage and retrieval of E-mail messages is available and installed," emails warranting 
preservation as records must be printed out and filed with related Department records.® NARA 
regulations codified in 2009 also specified that agencies must not use an electronic mail system 
to store the recordkeeping copy of electronic mail messages identified as Federal records unless 
that system contains specific features.^’ However, according to the Department, its technology 
has "lagged behind" this mandate. 


5 FAM 414.8 (September 17, 2004). The prior version was located in 5 FAM 413.10 (October 30, 1995). See also, 
NARA, Frequently Asked Questions about Records Management in General, available at: 
http://www.archives.gOv/records-mgmt/faqs/generai.html#responsibility (January 20, 2001) (stating that "Federal 
employees are responsible for making and keeping records of their work."). 

5 FAM 443.3 (October 30, 1995). S/ES-IRM reported to OIG that it has preserved email files numbering in the 
thousands for selected senior officials dating back at least as far as Secretary Powell's administration, although OIG 
found that these files are maintained in a format that makes them almost impossible to review or use. 

36 CF.R. § 1236.22 (2009). These required features are specified in 36 CF.R. § 1236.20(b) as follows: 

(a) General. Agencies must use electronic or paper recordkeeping systems or a combination of those 
systems, depending on their business needs, for managing their records. Transitory email may be managed 
as specified in S 1236.22(c). 

(b) Electronic recordkeeping. Recordkeeping functionality may be built into the electronic information 
system or records can be transferred to an electronic recordkeeping repository, such as a DoD-5015.2 STD- 
certified product. The following functionalities are necessary for electronic recordkeeping: 

(1) Declare records. Assign unique identifiers to records. 

(2) Capture records. Import records from other sources, manually enter records into the system, or 
link records to other systems. 

(3) Organize records. Associate with an approved records schedule and disposition instruction. 

(4) Maintain records security. Prevent the unauthorized access, modification, or deletion of declared 
records, and ensure that appropriate audit trails are in place to track use of the records. 

(5) Manage access and retrieval. Establish the appropriate rights for users to access the records and 
facilitate the search and retrieval of records. 

(6) Preserve records. Ensure that ail records in the system are retrievable and usable for as long as 
needed to conduct agency business and to meet NARA-approved dispositions. Agencies must 
develop procedures to enable the migration of records and their associated metadata to new 
storage media or formats in order to avoid loss due to media decay or technology obsolescence. 
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In 2009, IRM introduced SMART throughout the Department, enabling employees to preserve a 
record copy of emails through their Department email accounts rwithout having to print and file 
them.^^ However, the Office of the Secretary elected not to use SMART to preserve emails, in part 
because of concerns that the system would allow overly broad access to sensitive materials. As a 
result, printing and filing remained the only method by which emails could properly be preserved 
within the Office of the Secretary in full compliance with existing FAM guidance. 

In August 2012, 0MB and NARA issued a memorandum requiring agencies to eliminate paper 
recordkeeping and manage all email records in an electronic format by December 31, 2016.^^ 
Subsequently, in August 2013, NARA published a bulletin authorizing agencies to use the 
Capstone approach to manage emails based upon the sender or recipient's role within the 
agency (rather than the content of the email), which "allows for the capture of records that 
should be preserved as permanent from the accounts of officials at or near the top of an agency 
or an organizational subcomponent."^ In February 2015, S/ES began retaining the emails of 
senior Department officials within its purview using the Capstone approach, a practice that was 
broadened to approximately 200 senior officials across the Department in September 2015.^* 
However, if an employee is not a senior official under Capstone, he or she would still be 
responsible for preserving emails in an appropriate agency recordkeeping system, such as 
through the use of SMART or printing and filing. 

Requirements for Email Records in Personal Accounts; As previously stated, documents can 
qualify as Federal records regardless of the location, method of creation, or the medium 
involved. Consequently, records management requirements have always applied to emails 


(7) Execute disposition. Identify and effect the transfer of permanent records to NARA based on 
approved records schedules. Identify and delete temporary records that are eligible for disposal. 
Apply records hold or freeze on disposition when required. 

(c) Backup systems. System and file backup processes and media do not provide the appropriate 
recordkeeping functionalities and must not be used as the agency electronic recordkeeping system. 

Prior OIG reports have observed that that use of the SMART system to create record emails has varied widely across 
Department offices. OIG, Review of State Messaging and Archive Retrieval Toolset and Record BmaU (ISP-I-15-15, 
March 2015) and OIG, Inspection of the Bureau of Administration, Global Information Services, Office of Information 
Programs and Services (^SP-l-12-SA, September 2012). 

0MB and NARA, Memorandum for The Heads of Executive Departments and Agencies and Independent Agencies: 
Managing Government Records Directive (0MB Memorandum M-12-18) (August 24, 2012). 

NARA, Guidance on a New Approach to Managing Email Records, Bulletin No. 2013-02 (August 29, 2013), available 
at https://www.archives.gov/records-mgmt/bulletins/2013/2013-02.htm!. 

On January 29, 2015, the Executive Secretary notifi^i the covered officials in the offices of the Secretary (S), the 
Deputy Secretaries of State (D), the Under Secretary for Politital Affairs (P), and the Counselor of the Department (C) 
that on February 1, 2015, S/ES-IRM would begin permanently retaining all email activity in their State Department 
accounts. This notice also stated: "You should not use your private email accounts (e.g., Gmail) for official business." 
Later in 2015, the Under Secretary for Management notified all Assistant Secretaries and equivalents and Principal 
Deputies that all their email will be permanently stored and indexed beginning September 1, 2015. See Memorandum 
To AH Assistant Secretaries, Assistant Secretary Equivalent, And Principal Deputies: Email Retention (July 29, 2015). 
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exchanged on personal email accounts, provided their content meets the definition of a record. 
In 2004, NARA issued a bulletin noting that officials and employees "must know how to ensure 
that records are incorporated into files or electronic recordkeeping systems, especially records 
that were generated electronically on personal computers." In 2009, NARA amended its 
regulations explicitly to address official emails on personal accounts: 

Agencies that allow employees to send and receive official electronic mail messages 
using a system not operated by the agency must ensure that Federal records sent or 
received on such systems are preserved in the appropriate agency recordkeeping 
system.^® 

In the 2014 amendments to the Federal Records Act, Congress added a provision prohibiting 
agency employees from creating or sending a record using "a non-official electronic messaging 
account” unless they copy their official electronic messaging account in the original creation or 
transmission of the record or forward a complete copy of the record to their official electronic 
messaging account within 20 days.^' Shortly before the enactment of the 2014 amendments, the 
Department issued an interim directive with similar requirements^® and subsequently updated 
the FAM in October 2015 as follows: 

Under the Presidential and Federal Records Act Amendments of 2014, employees are 
prohibited from creating or sending a record using a non-official email account unless 
the employee (1) copies the employee's official email account in the original creation or 
transmission, or (2) forwards a complete copy of record (including any attachments) to 
the employee's official email account not later than 20 days after the original creation or 
transmission. ...The U.S. National Archives and Records Administration has advised that 
"personal accounts should only be used in exceptional circumstances." Therefore, 
Department employees are discouraged from using private email accounts (e.g., Gmail, 
AOL, Hotmail, etc.) for official business. However, in those very limited circumstances 
when it becomes necessary to do so, the email messages covering official business sent 
from or received in a personal account must be captured and managed in a Department 
email system in a manner described above in accordance with the Presidential and 
Federal Records Act Amendments of 2014. If an employee has any emails (regardless of 
age) on his or her private email account(s) that have not already been forwarded to the 
employee's official email account, then such emails need to be forwarded to the 
employee's state.gov account as soon as possible. Employees are reminded that private 
email accounts should not be used to transmit or receive classified information.^^ 


* 36 C.F.R. 5 1236.22(b). 

” 44 U.S.C. § 2911(a). 

Department of State, A Message from Under Secretary for Management Patrick F. Kennedy regarding State 
Department Records Responsibilities and Policy, Announcement No. 20i4_10_l 15, October 17, 2014. 

5 FAM 443.7 (October 23, 2015). Furthermore, the Consolidated Appropriations Act of 2016, which became Public 
Law 114-113 on December 18, 2015, requires, at Section 7077, that the Department update policies and directives 
needed to comply with Federal statutes, regulations, and presidential executive orders and memoranda concerning 
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However, forwarding to or copying an employee's official email account alone is not sufficient to 
fully meet records management requirements unless an employee's email is being captured 
under the Capstone approach. If such an email qualifies as a record, employees are still 
responsible for preserving it in an appropriate agency recordkeeping system, such as through 
the use of SMART or printing and filing. 

Safeguards for Loss or Removal of Records: Both the Federal Records Act and NARA regulations 
also focus on preventing the removal, loss, or alienation of Federal records. The Act requires the 
head of each agency to establish safeguards against the removal or loss of records, including 
making it known to officials and employees of the agency (1) that records in the custody of the 
agency are not to be alienated or destroyed and (2) the penalties provided by law for the 
unlawful removal or destruction of records.'*" Although the FAM itself does not contain any 
explicit administrative penalties for removal or destruction of records, it does advise employees 
that such penalties exist and cites the Federal Records Act for this assertion.'*’ 

NARA regulations require each agency to have procedures to ensure that departing officials and 
employees do not remove Federal records from agency custody."*^ The Department has 
implemented these requirements through various FAM and FAH provisions that prohibit 
employees from removing, retiring, transferring, or destroying Department records; prohibit 
departing employees from removing any records; require each departing employee to sign a 
separation statement certifying that he or she has surrendered all documentation related to the 
official business of the Government; and require a review of documents proposed for removal 
by a departing employee. For example, since 1982, the Department has given the 


the preservation of all records made or received in the conduct of official business, including record emails, instant 
messaging, and other online tools. The Act also required the Department to direct departing employees that their 
records belong to the Federal government and to report within 30 days on the steps required to implement the 
recommendations issued by OIG in the March 2015 Review of State Messaging and Archive Retrieval Toolset and 
Record Email (ISP-1-15-15) and any recommendations from the OIG review of the records management practices of 
the Department of State. Section 7077 also contains a prohibition from the use of certain appropriated lijnds to 
support the use or establishment of email accounts or email servers created outside the .gov domain or not fitted for 
automated records management as part of a Federal government records management program in contravention of 
the Presidential and Federal Records Act Amendments of 2014 and a provision for withholding $10,000,000 from the 
Capital Investment Fund until the records management reports required under Section 7077 are submitted to 
Congress. 

44 U.S.C. § 3105. 

5 FAM 413(a)(6) (September 17, 2004). NARA's regulations Interpreting the Federal Records Act refer to the criminal 
penalties in 18 U.S.C. §§ 641, 2071, but do not cite to any administrative penalties. 36 C.F.R. 1 1230.12. 

® 36 C.F.R. § 1222.24(a)(6) (October 2, 2009). 

'*’ S FAM 431.5(d) (July 31, 2012): 5 FAM 432.4(d) (July 31, 2012); 5 FAM 414.7 (June 19, 2015); 12 FAM 564.4 (July 10, 
2015): 5 FAH-4 H'217.2 (August 13, 2008). These are the most current versions of these provisions, but the 
requirements have existed at least since 1995. See also 5 FAH-4 H-218a (April 15, 1997). For related discussions of 
agency responsibilities concerning removal of agency documents by senior officials upon departure, see also GAO, 
Federal Records: Removal of Agency Documents by Senior Officials Upon Leaving Office (GAO/GG D-89-91, July 1989), 
and GAO, Document Removal by Agency Heads Needs Independent Oversight (GkO/GGO-91-in, August 1991). 


ESP-16-03 


UNCLASSIFIED 


10 


170 


UNOASSIHED 


responsibility to the management section of each bureau, office, or post to ensure that every 
departing employee has signed a separation statement (form DS-109) that includes the 
following certification: "I have surrendered to responsible officials all unclassified documents and 
papers relating to the official business of the Government acquired by me while in the employ of 
the Department."" Numerous Department cables and announcements have emphasized the 
responsibility of every employee to sign a separation statement before she or he departs.''* 

Since 2004, both the Department and NARA have issued multiple notices emphasizing the need 
to preserve emails that constitute Federal records and to surrender all Federal records prior to 
departing government employment.''* These include an August 2004 memorandum from the 
Executive Secretary that reminded departing officials not to remove any documentary materials, 
whether personal or official and whether in written or electronic form, until such materials have 
been reviewed by records and security officers. The memorandum also required departing 
officials to ensure that all record material they possess is incorporated in the Department's 
official files. The Department reiterated this guidance in April, June, and October 2008.'"' S/ES 
conducts annual workshops with the Agency Records Officer on records management for 
departing senior officials and their staffs. Such workshops were held in February 2007, 

September 2008, June 2009, April 2010, October 2011, October 2012, October 2013, October 
2014, and June 2015. 


" 5 FAM 417.2 (March 16, 1982): S FAM 413.9 (October 30, 1995): 5 FAM 414.7 (September 17, 2004). 

*** See, e.g., Procedures for the Removal of Persona! Papers and Non-Record Material -SPAM 400, 5 FAH-4, 
Announcement No. 20G0_01_021, January 14, 2000; Procedures for the Removal of Personal Papers and Non-Record 
Material, Announcement No. 200S_02.017, February 3, 2005: 05 STATE 00018818 (February 1, 2005): 14 STATE 56010 
(May 09, 2014). 

‘'*5ee, eg., NARA, Protecting Federal records and other documentary materials from unauthorized removal, Bulletin 
No. 2005-03 (December 22, 2004); NARA, NARA Guidance for Implementing Section 207(e} of the E-Government Act 
of 2002, Bulletin No. 2006-02 (December 15, 2005); Department of State, Records Management Procedures, 
Announcement No. 2007„02_147, February 28, 2007; Department of State, Preserving Electronic Message (E-mail) 
Records, Announcement No. 2009_06„090, June 17, 2009; 14 STATE 111506 (September 15, 2014); Department of 
State, Departing Officials: Procedures for the Removal of Persona! Papers and Non-Record Material, Announcement 
No. 2008_04_089, April 17, 2008; Department of State, Reminder- Departing Officials: Procedures for the Removal of 
Personal Papers and Non-Record Material, Announcement No. 2008_06_095, June 16, 2008; Department of State, 
Reminder - Departing Officials: Procedures for the Removal of Persona! Papers and Non-Record Material, 
Announcement No, 200S„10_087, October 16, 2008 ("The willful and unlawful removal or destruction of records is 
punishable by a fine or imprisonment of up to three years, or both (18 U.S.C. § 2071)."); 09 STATE 120561 (November 
23, 2009); Department of State, Records Management Responsibilities, Announcement No. 2009_11„125, November 
23, 2009; NARA, Continuing Agency Responsibilities for Scheduling Electronic Records, Bulletin No. 2010-02 (February 
5, 2010); Department of State, A Message from Undersecretary for Management Patrick F. Kennedy regarding State 
Department Records Responsibilities and Policy, Announcement No. 2014_10_115, October 17, 2014, 

Memorandum from Karl Hoffman, Executive Secretary, to all Under Secretaries and Assistant Secretaries, Refresher 
on Records Responsibilities and Review (August 9, 2004). 
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MANAGEMENT WEAKNESSES CONTRIBUTE TO LOSS OF 
EMAIL RECORDS 

As discussed above, the Federal Records Act and related NARA regulations impose records 
management responsibilities on both Federal agencies and individual employees. For agencies, 
these responsibilities include establishing "effective controls" to manage the creation, 
maintenance, use, and disposition of records in order to achieve adequate and proper 
documentation of the policies and transactions of the Federal Government.''^ According to 
NARA, an effective records disposition program depends on scheduling''^ all records, regardless 
of location and regardless of physical form or characteristics (paper or electronic).™ Therefore, 
agencies must implement a records maintenance program so that complete records are filed or 
otherwise identified and preserved, records can be readily found when needed, and permanent 
and temporary records are physically segregated or are segregable from each other.*' 

According to a 2010 U.S. Government Accountability Office (GAO) report, most agencies do not 
prioritize records management, as evidenced by lack of staff and budget resources, absence of 
up-to-date policies and procedures, lack of training, and lack of accountability.™ In its most 
recent annual assessment of records management, NARA identified similar weaknesses across 
the Federal Government with regard to electronic records in particular. NARA reported that 80 
percent of agencies had an elevated risk for the improper management of electronic records, 
reflecting serious challenges handling vast amounts of email, integrating records management 
functionality into electronic systems, and adapting to the changing technological and regulatory 
environments.™ 

In an effort to develop solutions to its own electronic records management challenges and to 
comply with NARA and 0MB requirements, in 2013 the Department established the Electronic 
Records Management Working Group (ERMWG).” The Under Secretary for Management™ 


44 U.S.C. §S 3101, 3102. 

■” A records schedule identifies records as either temporary or permanent. All records schedules must be approved by 
NARA. A records schedule provides mandatory instructions for the disposition of the records (including the transfer of 
permanent records and disposal of temporary records) when they are no longer needed by the agency. As part of the 
ongoing records life cycle, disposition should occur in the normal course of agency business. 44 U.S.C. §§ 3303, 3303a. 
“ http://www.archives.gov/records-mgmt/publications/disposition-of-federal-records/chapter-2.html 
“ 36 CF.R. § 1222.34. 

GAO, Information Management: The Challenges of Managing Electronic Records (GAO~10-83ST, July 17, 2010). 

NARA, Records Management Self-Assessment 2014 {Hovetnbet 6, 2015), 

** The ERMWG is charred by the Director of the Office of Management Policy, Rightsizing and innovation, and its 
members include the Chief Information Officer (QO) and representatives from L, IRM, and A. 

** 0MB and NARA Memorandum M-12-18, Memorandum for The Heads of Executive Departments and Agencies and 
Independent Agencies: Managing Government Records Directive, requires each agency to designate a Senior Agency 
Official (SAO) at the Assistant Secretary level or its equivalent with "direct responsibility for ensuring the department 
or agency efficiently and appropriately complies with all applicable records management statutes, regulations, and 
NARA policy, and the requirements of this Directive. The SAO must be located within the organization so as to make 
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approved recommendations submitted by the ERMWG, which included updating guidance on 
preserving senior officials' emails, developing a pilot program for the Capstone approach to 
record email, and directing IRM to perform a cost-benefit analysis of upgrading SMART as 
opposed to obtaining other solutions for preserving the emails of senior officials,^ 

In September 2015, Secretary Kerry named a former career Senior Foreign Service Officer as the 
Department's Transparency Coordinator. The Transparency Coordinator has been tasked with 
leading the Department’s efforts in conjunction with the ERMWG to meet the President's 
Managing Government Records directive, responding to OIG's recommendations, and working 
with other agencies and the private sector to explore best practices and new technologies. 

While these are positive steps, OIG identified multiple email and other electronic records 
management issues during the course of this evaluation. In its technical comments on this 
report, the Department noted that its budget has been declining over the past years and has not 
kept pace with inflation at a time when its national security mission is growing. According to the 
Department, it did request additional resources for records management for fiscal year 2017, but 
additional funding will still be needed to fully address its records management challenges. 

Insufficient Oversight of the Recordkeeping Process: During the 20-year period covered by this 
evaluation, S/ES has had day-to-day responsibility for the Secretary of State's records 
management responsibilities, and it relies upon guidance and records schedules promulgated 
by the Bureau of Administration. The Bureau of Administration "plans, develops, implements, 
and evaluates programs, policies, rules, regulations, practices, and procedures on behalf of the 
Secretary to ensure compliance with the letter and spirit of relevant statutes, executive orders, 
and guidelines."” The Office of Information Programs and Services (IPS) is the component of the 
Bureau specifically tasked with issuing records guidance and overseeing records management 
efforts of the Department. Upon request, IPS reviews the records management practices of 
Department offices. The Acting Co-Director of IPS currently serves as the Agency Records Officer 
with program management responsibility for all records Department-wide throughout their life 
cycle (creation, acquisition, maintenance, use, and disposition). IPS has provided briefings, in 
conjunction with S/ES, to Office of the Secretary staff and has issued Department-wide notices 
and cables about records retention requirements, some of which included requirements to save 
email records, including records contained in personal emails. According to the FAM, the 
Agency Records Officer is "responsible for seeing that the Department and all of its component 
elements in the United States and abroad are in compliance with Federal records statutes and 


adjustments to agency practices, personnel, and funding as may be necessary to ensure compliance and support the 
business needs of the department or agency." The Under Secretary for Management has served as the Department's 
SAO since 2012. Action Memo for the Secretary, Designating A Senior Agency Official (SAO) for Managing 
Government Records {November 27, 2012). 

* ERMWG, Action Memo for Under Secretary Kennedy: Preserving Electronically Senior Officials ' Record Email 
Messages (August 22, 2014). 

” 5 FAM 414.3 (June 9, 2009). 
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regulations, yet IPS has not reviewed Office of the Secretary records retention practices 
during the current or past four Secretaries' terms. 

Although NARA is responsible for conducting inspections or surveys of agencies' records and 
records management programs and practices,^® it last reviewed the Office of the Secretary's 
records retention practices in 1991-a quarter century ago. Beginning in 2009, NARA has relied 
on annua! records management self-assessments and periodic reports from the Department to 
gauge the need to conduct formal inspections. The Department's last two self-assessments did 
not highlight any deficiencies. 

Print and File Requirements Not Enforced: S/ES staff have provided numerous trainings for the 
Office of the Secretary on records preservation responsibilities and the requirement to print and 
file email records. However, S/ES staff told OIG that employees in the Office of the Secretary 
have printed and filed such emails only sporadically. In its discussions with OIG, NARA stated 
that this lack of compliance exists across the government. Although the Department is aware of 
the failure to print and file, the FAM contains no explicit penalties for lack of compliance, and 
the Department has never proposed discipline against an employee for failure to comply. OIG 
identified one email exchange occurring shortly before Secretary Clinton joined the Department 
that demonstrated a reluctance to communicate the requirement to incoming staff. In the 
exchange, records officials within the Bureau of Administration wondered whether there was an 
electronic method that could be used to capture the Secretary's emails because they were "not 
comfortable" advising the new administration to print and file email records. 

Limited Ability To Retrieve Email Records: Even when emails are printed and filed, they are 
generally not inventoried or indexed and are therefore difficult to retrieve. As an illustration, 
almost 3,000 boxes, each filled with hundreds of pages of documents, would have to be 
reviewed manually, on a page-by-page basis, in order to identify and review all printed and filed 
emails from the Office of the Secretary since 1997. To help alleviate this problem, the Office of 
the Secretary could have adopted an electronic email management system in 2009 with the 
introduction of SMART. SMART allows users to designate specific emails sent or received 
through the Department's email system as record emails; other SMART users can search for and 
access record emails, depending on the access controls set by the individual who originally 
saved the email. However, prior OIG reports have repeatedly found that Department employees 
enter relatively few of their emails into the SMART system and that compliance varies greatly 
across bureaus, in part because of perceptions by Department employees that SMART is not 
intuitive, is difficult to use, and has some technical problems,® 


“ 5 FAM 414.2 (June 9, 2009). 

“ 44 U.S.C. § 2906. For an in-depth assessment of NARA's oversight practices, see GAO, National Archives and 
Records Administration: Oversight and Management Improvements Initiated, but More Action Needed {QkO-ll-lS, 

October 2010). 

“ OIG, Review of State Messaging and Archive Retrieval Toolset and Record Email CISP-I-15-15, March 2015) and OIG, 
Inspection of the Bureau of Administration, Global Information Sendees, Office of Information Programs and Services 
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In 2015, the Department began permanently retaining the emails of approximately 200 senior 
officials pursuant to the Capstone approach discussed previously. The Department also plans to 
purchase an off-the-shelf product to electronically manage its emails in keeping with OMB's and 
NARA's requirement that it do so by December 2016.*^ This product will be adapted to 
Department requirements to include an interface that requires users to determine the record 
value and sensitivity of an email with one click and an auto-tagging feature that will allow emails 
to be stored according to disposition schedules. The new system will also be able to process 
legacy email files, such as the Personal Storage Table (.pst) files of departed officials.^ In 
addition, the Department expects that the product will improve the Department's ability to 
perform more comprehensive email searches. 

No Inventory of Archived Electronic Files; The S/ES Office of Information Resources 
Management (S/ES-IRM), the unit that handles information technology for the Office of the 
Secretary, reported to OIG that it has maintained electronic copies of email records for selected 
senior officials dating back as far as Secretary Powell's tenure. These records consist of 
thousands of electronic files, principally saved as .pst files. During OIG's fieldwork, S/ES-IRM did 
not have an inventory of the .pst or other electronic files that consistently identified the former 
email account holder, However, in early 2016, S/ES-IRM began to create a comprehensive 
inventory of these fiies.“ 

Unavailable or Inaccessible Electronic Files: When OIG requested specific .pst files, it 
encountered difficulties in obtaining and accessing those files. S/ES-IRM was unable to produce 
all of the .pst files OIG requested, and some of the requested files were corrupted and their 
recovery required considerable resources. Some ,pst files were password protected, and staff did 
not know the passwords needed to open those files. Other files contained no data at all. Of the 
.pst files OIG was able to review, many were incomplete in that they did not span the particular 
employee's entire term of service, were mislabeled, or were missing key files such as populated 
sent or inbox folders. According to S/ES-IRM, as part of the inventory process currently 
underway, it is moving all .pst files in its possession onto servers and clearly labeling them. 

Failure To Transfer Email Records to IPS: All Department offices are required to retire, or transfer, 
records to IPS in accordance with the Department's records disposition schedules,^ For records 


(ISP'I-12-54, September 2012). As noted previously, the Office of the Secretary did not implement SMART in part 
because of concerns the system would allow users to access highly sensitive records. 

On November 30, 2015, the Department Issued a Request for Information to determine the capabilities of the 
private sector to provide and support a system to satisfy recordkeeping requirements involving emails by December 
31, 2016. Department of State Email Management Solicitation No. SAQMMA16I0008 {November 30, 2015). 

The term ".pst" refers to the format used to store copies of email messages, calendar events, and other items within 
Microsoft software. 

According to NARA regulations, creating .pst files is not an approved method of preserving Federal records, 
because .pst files do not have the required controls of an electronic records system. 36 C.F.R. § 1236.10. 

^ 5 FAM 433 (July 31, 2012). 
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specific to the Office of the Secretary, the relevant schedules require transferring most records 
to IPS at the end of the tenure of the Secretary.® S/ES has regularly retired paper copies of such 
records throughout the Secretaries' terms. However, S/ES has not consistently retired electronic 
email records. In April 2015, S/ES retired nine lots of electronic records containing approximately 
16 gigabytes of data, consisting of emails, memoranda, travel records, and administrative 
documents from the tenures of former Secretaries Powell, Rice, and Clinton. However, the only 
email accounts included in this material were those of six of former Secretary Powell's staff and 
two of former Secretary Rice’s staff. No email accounts from Secretary Clinton's staff were in the 
retired material. 

In addition to retiring records in accordance with disposition schedules, offices must comply 
with Department policy requiring them to electronically capture the email accounts of selected 
senior officials upon their departure. A January 2009 memorandum from the Under Secretary for 
Management required Executive Directors and Management Officers to notify their system 
administrators of the departure of Presidential and political appointees and directed the 
administrators to copy the email accounts of those officials to two sets of CDs. The 
memorandum instructed the office to keep one of the CDs and send the other to IPS for records 
preservation.® The memorandum included an attachment identifying all officials who were 
subject to these requirements, including 50 officials from the offices under the purview of S/ES.®^ 
In August 2014, the Under Secretary sent another memorandum reiterating the requirement to 
electronically capture the email accounts of senior officials and broadening the list of officials 
subject to the requirement.® The Director of S/ES-IRM told OIG that S/ES complied with this 
requirement by creating .pst files covering the email accounts of the specified officials upon 
their departure. However, S/ES has never sent any CDs to IPS. In its most recent self-assessments 
of its records management, the Department stated that it has "established a procedure for 
departing officials to have their emails sent to the Department's Records Officer for 
preservation," but it failed to note that it has not complied with that procedure for the most 
senior officials in the organization.® 

Failure To Follow Department Separation Processes: As noted previously, NARA regulations 
require each agency to adopt procedures to ensure that departing officials and employees do 


The schedule for records specific to the Office of the Secretary is avaitabie at: 
https://foia.state.gov/_docs/RecorclsDi5positlon/A-01.pdf 
Under Secretary Patrick F. Kennedy, Memorandum for AH Under Secretaries, Assistant Secretaries, Executive 
Directors and Post Management Officers: Preserving EiectronicaHy the Email of Senior Officials upon their Departure 
(January 2009). 

The list of officials included the Secretary, Deputy Secretaries. Counselor, Chief of Protocol Special Assistants to the 
Secretary, the Chief of Staff, and the Deputy Chief of Staff. 

Under Secretary Patrick F. Kennedy, Memorandum: Senior Officials' Records Management Responsibilities {kuqu%\. 
28, 2014). 

See, e.g., Department of State, Senior Agency Official for Records Management FY 2014 Annual Report Template 
(February 5, 2015). 


ESP-16-03 


UNCLASSIFIED 


16 


176 


UNCLASSIHED 


not remove Federal records from agency custody.™ The Department has implemented these 
requirements through various FAM provisions, including one that requires every departing 
employee to sign a separation statement (DS-109) certifying that he or she has surrendered ail 
documentation related to the official business of the Government.” This function is handled for 
the Office of the Secretary by the Office of the S/ES Executive Director (S/ES-EX). However, S/ES- 
EX told OIG that, as the head of the agency, the Secretary is not asked to follow the exit process. 
Consequently, Secretaries Albright, Powell, Rice, and Clinton did not sign a DS-109 at the end of 
their tenures. 

Notwithstanding the failure to adhere to separation requirements, all departing Secretaries of 
State from Secretary Albright on have followed the procedures governing the removal of 
personal papers. The FAH specifies that departing officials who wish to remove any documents 
must prepare an inventory of these personal papers and any non-record materials for review by 
Department officials.’^ Once the reviewing official is satisfied that removal of the documents 
would comply with Federal law and regulations, the reviewing official completes and signs Form 
DS-1904 (Authorization for the Removal of Personal Papers and Non-Record Materials). As the 
form itself notes, this process is especially important to ensure that the "the official records of 
the Department" are not "diminishfed]." S/ES officials signed DS-1904 forms after the departures 
of Secretaries Albright, Powell, Rice, and Clinton. OIG reviewed the completed forms for these 
four Secretaries; none listed email as proposed for removal. However, in contrast to the Form 
DS-109, the DS-1904 does not impose a specific requirement to surrender documents. 

Failure To Notify NARA of Loss of Records: Federal laws and regulations require an agency head 
to notify NARA of any actual, impending, or threatened unlawful removal or loss of agency 
records.^^ Although numerous senior officials emailed Secretaries Powell and Clinton on their 
personal email accounts to conduct official business, the Department did not make a formal 
request to the former Secretaries for the Federal records contained within these personal 
accounts until October and November 2014.” The Department also did not promptly notify 
NARA about the potential loss of records.^^ NARA officials told OIG they learned of former 


™ 36 CF.R. § 1222.24 (2009). 

12 FAM 564.4 (July 10, 2015); 5 FAM 414.7 (June 9, 2015). These are the most current versions of these provisions, 
but the requirements have existed since at (east 1995. 

” 5 FAH-4 H-217.2 (August 13, 2008). 

” 44 U.S.C, § 3106: 36 C.F.R. S 1230.14. 

” !n letters to the respective representatives of Secretaries Powell and Clinton, the Department asked that, should 
they "be aware or become aware in the future of a federal record, such as an email sent or received on a personal 
email account while serving as Secretary of State, that a copy of this record be made available to the Department." In 
addition, the Department advised that they should "note that diverse Department records are subject to various 
disposition schedules, with most Secretary of State records retained permanently," Therefore, the Department asked 
that "a record be provided to the Department if there is reason to believe that it may not otherwise be preserved in 
the Department recordkeeping system." 

” In May 2014, the Department undertook efforts to recover potential Federal records from Secretary Clinton. 
Thereafter, in July 2014, senior officials met with former members of Secretary Clinton's immediate staff, who were 
then acting as Secretary Clinton’s representatives. At the meeting, her representative indicated that her practice of 
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Secretary Clinton's email practices through media accounts in March 2015. Immediately 
thereafter, NARA requested that the Department provide a report concerning “the potential 
alienation of Federal email records” created by former Secretary Clinton and actions taken to 
recover such records.^® 

In April 2015, the Department informed NARA of the information it obtained from the former 
Secretaries concerning their email records.” NARA subsequently requested additional 
information about how the Department implements records management requirements with 
regard to senior officials.™ NARA also requested that the Department contact the Internet 
service providers (ISPs) associated with the personal accounts of Secretaries Powell and Clinton 
to inquire if "it is still possible to retrieve the email records that may still be present on their 
servers.” The Under Secretary for Management subsequently informed NARA that the 
Department sent letters to the representatives of Powell and Clinton conveying this request.™ 

Well before the disclosure in April 2015, Department officials discussed in 2011 whether there 
was an obligation to search personal email accounts for Federal records.® In 2013, this issue 
arose again. Specifically, in early June 2013, Department staff participating in the review of 
potential material for production to congressional committees examining the September 2012 
Benghazi attack discovered emails sent by the former Policy Planning Director via his 
Department email account to a personal email address associated with Secretary Clinton. In 
ensuing weeks, partly as a result of the staff's discovery. Department senior officials discussed 


using a personal account was based on Secretary Powell's similar use, but Department staff instructed Clinton's 
representatives to provide the Department with any Federal records transmitted through her personal system. On 
August 22, 2014, Secretary Clinton's former Chief of Staff and then-representative advised Department leadership that 
hard copies of Secretary Clinton emails containing responsive information would be provided but that, given the 
volume of emails, it would take some time to produce. Subsequently, in October 2014, the Department began making 
formal, written requests to the representatives of Secretaries Albright Powell, Rice and Clinton to produce any Federal 
records maintained in persona! accounts. Secretary Clinton produced emails in hard copy form in December 2014. 
Thereafter, in March 2015, the Department made a similar request to four of Secretary Clinton's immediate staff. 

They produced email from their personal accounts during the summer of 2015. 

Letter from Paul M. Wester, Jr., Chief Records Officer for the U5. Government NARA, to Margaret P. Grafeid, 

Deputy Assistant Secretary for Global Information Systems, Bureau of Administration, U.S. Department of State (March 
3, 2015). 

Grafeid Letter. 

Letter from Paul M. Wester, Jr., Chief Records Officer for the U.S. Government NARA, to Margaret P. Grafeid, 

Deputy Assistant Secretary for Global Information Systems, Bureau of Administration, U.S. Department of State (July 2, 
2015). 

^ Letter from Patrick F. Kennedy, Under Secretary of State for Management to Laurence Brewer, Acting Chief Records 
Officer for the U.S. Government NARA (November 6, 2015). Secretary Clinton responded to the Department that she 
has provided it with ail official emails in her possession and pledged to provide any other record emails if they 
become available. As of May 2016, the Department has not received a response from Secretary Powell. 

This was prompted by a FOIA matter. In which a plaintiff inquired about a document it received showing that a staff 
assistant in the Office of the Secretary had received a work-related email on her persona! account from someone who 
was not a Federal employee; the staff assistant had forwarded the email to her official account. This matter was 
ultimately resolved without ftirther litigation. 


ESP-16-03 


UNCLASSIRED 


18 



178 


UNCLASSHED 


the Department's obligations under the Federal Records Act in the context of personal email 
accounts. As discussed earlier in this report, laws and regulations did not prohibit employees 
from using their personal email accounts for the conduct of official Department business. 
However, email messages regarding official business sent to or from a personal email account 
fell within the scope of the Federal Records Act if their contents met the Act's definition of a 
record. OIG found that the Department took no action to notify NARA of a potential loss of 
records at any point in time.®' 


STAFF EMAIL USAGE AND COMPLIANCE WITH RECORDS 
MANAGEMENT REQUIREMENTS VARY 


As part of this evaluation, OIG sought to examine whether staff in the Office of the Secretary 
complied with relevant email records management requirements, including those associated 
with the use of personal email accounts. However, OIG was unable to systematically assess the 
extent to which Secretaries Albright, Powell, Rice, Clinton, and Kerry and their immediate staff 
managed and preserved email records. In particular, OIG could not readily retrieve and analyze 
email records, in part because of the previously discussed weaknesses in the Department's 
records management processes. Although hard-copy and electronic email records dating back 
to Secretary Albright's tenure exist, these records have never been organized or indexed. For 
example, the Department could not immediately retrieve and make available for review specific 
email accounts identified and requested by OIG, which led to 2- to 3-month-long delays in 
obtaining the requested records. In addition, OIG was unable to reconstruct many events 
because of staff turnover and current employees' limited recollections of past events. These 
problems were compounded by the fact that multiple former Department employees and other 
individuals declined OIG requests for interviews, and OIG lacks the authority to compel anyone 
who is not a current Department employee to submit to interviews or to answer questions. 

Moreover, OIG was unable to assess the degree to which Federal records sent though personal 
email accounts have been appropriately managed by Secretaries of State and their immediate 
staffs. Emails sent from the personal accounts of these individuals to other Department employees 
may or may not exist in the Department email accounts of the recipients, but OIG has limited 
ability to determine which accounts might contain these records unless the sender of the emails 
provides detailed information about the recipients. The Department currently lacks the resources 
and technical means to systematically review electronic files in its possession for records. 

Despite these issues, OIG discovered anecdotal examples suggesting that Department staff have 
used personal email accounts to conduct official business, with wide variations among 

The current Deputy Secretary for Management and Resources, who during the summer of 2013 served as Counselor 
to the Department, told OIG that she recalled conversations with Secretary Kerry about email usage, but the 
conversations focused only on Secretary Kerry's practices. In his intenriew with OIG, Secretary Kerry reported that he 
was not involved in any of the discussions regarding Secretary Clinton's emails and that he first became aware of her 
exclusive use of a personal email account when an aide informed him around the time the information became public. 
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Secretaries and their immediate staff members. For instance, OIG reviewed the Department 
email accounts {.pst files) of senior Department employees who served on the immediate staffs 
of Secretary Powell and Secretary Rice between 2001 and 2008. Within these accounts, OIG 
identified more than 90 Department employees who periodically used personal email accounts 
to conduct official business, though OIG could not quantify the frequency of this use. 

OIG also reviewed an S/ES-IRM report prepared in 2010 showing that more than 9,200 emails 
were sent within one week from S/ES servers to 16 web-based email domains, including 
gmail.com, hotmail.com, and att.net.® S/ES-IRM told OIG that it no longer has access to the tool 
used to generate this particular report. In another instance, in a June 3, 2011, email message to 
Secretary Clinton with the subject line "Google email hacking and woeful state of civilian 
technology," a former Director of Policy Planning wrote: "State's technology is so antiquated 
that NO ONE uses a State-issued laptop and even high officials routinely end up using their 
home email accounts to be able to get their work done quickly and effectively." 

Notwithstanding the limitations on its ability to conduct a systematic evaluation, the information 
available allowed OIG to establish that email usage and compliance with statutory, regulatory, 
and Department requirements varied across the past five Secretaries’ tenures. The practices of 
each Secretary and their immediate staff are discussed below. 

Secretary Albright (January 23, 1997 - January 20, 2001): During Secretary Albright's tenure, 
desktop unclassified email and access to the Internet were not widely available to Department 
employees. OIG searched selected hard-copy records from her tenure and did not find any 
evidence to indicate that Secretary Albright used either Department or personal email accounts 
during that period. OIG additionally interviewed Secretary Albright and current and former 
Department staff, who further confirmed that she did not use email while serving as Secretary. In 
her interview with OIG, Secretary Albright noted that email use was still in its early stages when 
she became Secretary, and at the time she had no familiarity with the practice. 

With regard to Secretary Albright's immediate staff, OIG did not find any emails that appeared 
to be to or from personal accounts and only found a few emails from staff Department accounts 
related to the Secretary's schedule. Staff responses on OIG questionnaires also identified 
minimal email usage-though two staff noted retaining emails on “Department servers."® These 
responses suggest staff may not have consistently complied with the preservation requirement 
to print and file emails containing Federal records.® 


Not all of these emails may indicate the use of personal email to conduct official business. Some of these emails 
could be communications with individuals outside the Department. Others could be communications by employees 
on persona! matters, which is permissible under the Department's limited-use policy. 

OIG sent 13 questionnaires to former Secretary Albright’s staff and received 8 responses, of which 2 were 
anonymous. None of the respondents reported having a personal email account while employed with the 
Department, and most did not acknowledge using a Department account Two noted that they retained their emails 
on Department servers and one recalled receiving training on the topic of email preservation. 

« 5 FAM 443.3 {October 30, 1995). 
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Secretary Powell (January 20, 2001 - January 26, 2005): During Secretary Powell's tenure, the 
Department introduced for the first time unclassified desktop email and access to the Internet 
on a system known as OpenNet, which remains in use to this day. Secretary Powell did not 
employ a Department email account, even after OpenNet's introduction. He has publicly written: 

To complement the official State Department computer in my office, 1 installed a laptop 
computer on a private line. My personal email account on the laptop allowed me direct 
access to anyone online. I started shooting emails to my principal assistants, to individual 
ambassadors, and increasingly to my foreign-minister colleagues 

OIG identified emails sent from and received by Secretary Powell's personal account in selected 
records associated with Secretary Powell. During his interview with OIG, Secretary Powell stated 
that he accessed the email account via his personal laptop computer in his office, while 
traveling, and at his residence, but not through a mobile device. His representative advised the 
Department that Secretary Powell "did not retain those emails or make printed copies."® 
Secretary Powell also stated that neither he nor his representatives took any specific measures 
to preserve Federal records in his email account. Secretary Powell's representative told OIG that 
she asked Department staff responsible for recordkeeping whether they needed to do anything 
to preserve the Secretary's emails prior to his departure, though she could not recall the names 
or titles of these staff. According to the representative, the Department staff responded that the 
Secretary's emails would be captured on Department servers because the Secretary had emailed 
other Department employees. 

However, according to records management requirements and OIG's discussion with NARA, 
sending emails from a personal account to other employees at their Department accounts is not 
an appropriate method of preserving emails that constitute Federal records.®^ Guidance issued 
by both NARA and the Department emphasize that all employees have records management 
responsibilities and must make and preserve records that they send and receive.® Moreover, in 
keeping with NARA regulations,® the Department's policies specifically acknowledged that its 
email system at the time did not contain features necessary for long-term preservation of 
Federal records.® Therefore, Secretary Powell should have preserved any Federal records he 


Colin Powell, It Worked for Me, at 109 (2012). 

Grafeld Letter. 

® 36 C.F.R. § 1234.24(b)(2) (August 28, 1995). 

“ 5 FAIVI 414.8 (September 17, 2004). The prior version was located at 5 FAIvl 413.10 (October 30, 1995). See also, 
NARA, Frequently Asked Questions about Records Ivlanagement in General, available at: 

http://www.arcblves.gOv/records-mgmt/faqs/general.html#responsibility (January 20, 2001) (stating that "Federal 
employees are responsible for making and keeping records of their work.") 

36 C.F.R. §1234.24(d) (August 28, 1995). In 2009, this provision was moved to 36 CF.R, 51236.22(d) (October 2, 
2009). It states, "Agencies must not use an electronic mail system to store the recordkeeping copy of electronic mail 
messages identified as Federal records unless that system" has certain listed attributes. 

* As noted previously, Department guidance explained that messages must be printed and filed until "until 
technology allowing archival capabilities for long-term electronic storage and retrieval of E-mail records is available 
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created and received on his personal account by printing and filing those records with the 
related files in the Office of the Secretary.®^ 

NARA agrees that the records should have been printed and filed but also told OIG that any 
effort to transfer such records to the Department would have mitigated the failure to preserve 
these records. At a minimum, Secretary Powell should have surrendered all emails sent from or 
received in his personal account that related to Department business. Because he did not do so 
at the time that he departed government service or at any time thereafter, Secretary Powell did 
not comply with Department policies that were implemented in accordance with the Federal 
Records Act. In an attempt to address this deficiency, NARA requested that the Department 
inquire with Secretary Powell's "internet service or email provider" to determine whether it is still 
possible to retrieve the email records that might remain on its servers.®^ The Under Secretary for 
Management subsequently informed NARA that the Department sent a letter to Secretary 
Powell's representative conveying this request.^^ As of May 2016, the Department had not 
received a response from Secretary Powell or his representative. 

Members of Secretary Powell's immediate staff who responded to OIG questionnaires described 
minimal email usage overall — two staff recalled printing and filing emails in Department 
recordkeeping systems.®^ While the limited number of respondents also asserted they did not 
use personal email accounts for official business, OIG discovered some personal email usage for 
official business by Secretary Powell's staff through its own review of selected records. 

Secretary Rice Clanuary 26, 2005 - January 20, 2009); Secretary Rice and her representative 
advised the Department and OIG that the Secretary did not use either personal or Department 
email accounts for official business.®^ OIG searched selected records and did not find any 
evidence to indicate that the Secretary used such accounts during her tenure. 

OIG received limited responses on questionnaires sent to former Secretary Rice's staff. Two staff 
recalled printing and filing emails, and only one acknowledged the use of personal email 


and installed" that will preserve messages for "periods longer than current E-mail systems routinely maintain them." 5 
FAM 443.3 (October 30, 1995). 

5 FAM 443,3 (October 30, 1995). 

letter from Paul M. Wester, Jr., Chief Records Officer for the U.S. Government, NARA, to Margaret P. Grafeld, 

Deputy Assistant Secretary for Global Information Systems, Bureau of Administration, U.S. Department of State (July 2, 
2015). 

® Letter from Patrick F. Kennedy, Under Secretary of State for Management, to Laurence Brewer, Acting Chief Records 
Officer for the U.S. Government, NARA (November 6, 2015). 

^ OIG sent IS questionnaires to former Secretary Powell's staff and received 6 responses, of which one was 
anonymous. Two respondents stated they created records by printing copies of emails from their Department 
accounts and filing them into the Department's records system. One respondent recalled receiving records retention 
training. 

Grafeld Letter. 
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accounts for official business.®® OIG reviewed hard-copy and electronic records of Secretary 
Rice s immediate staff and discovered that other staff who did not reply to the questionnaire did 
use personal email accounts to conduct official business. 

Secretary Clinton (January 21 , 2009 - February 1, 2013): Former Secretary Clinton did not use a 
Department email account and has acknowledged using an email account maintained on a 
private server for official business. As discussed above, in December 2014, her representative 
produced to the Department 55,000 hard-copy pages of documents, representing 
approximately 30,000 emails that could potentially constitute Federal records that she sent or 
received from April 2009 through early 2013. Secretary Clinton's representative asserted that, 
because the Secretary emailed Department officials at their government email accounts, the 
Department already had records of the Secretary's email preserved within its recordkeeping 
systems.®® 

As previously discussed, however, sending emails from a personal account to other employees 
at their Department accounts is not an appropriate method of preserving any such emails that 
would constitute a Federal record. Therefore, Secretary Clinton should have preserved any 
Federal records she created and received on her personal account by printing and filing those 
records with the related files in the Office of the Secretary.®* At a minimum, Secretary Clinton 
should have surrendered all emails dealing with Department business before leaving 
government service and, because she did not do so, she did not comply with the Department's 
policies that were implemented in accordance with the Federal Records Act. 

NARA agrees with the foregoing assessment but told OIG that Secretary Clinton's production of 
55,000 pages of emails mitigated her failure to properly preserve emails that qualified as Federal 
records during her tenure and to surrender such records upon her departure. OIG concurs with 
NARA but also notes that Secretary Clinton's production was incomplete. For example, the 
Department and OIG both determined that the production included no email covering the first 
few months of Secretary Clinton's tenure — -from January 21, 2009, to March 17, 2009, for 
received messages: and from January 21, 2009, to April 12, 2009, for sent messages. OIG 
discovered multiple instances in which Secretary Clinton's personal email account sent and 
received official business email during this period. For instance, the Department of Defense 
provided to OIG in September 2015 copies of 19 emails between Secretary Clinton and General 
David Petraeus on his official Department of Defense email account; these 19 emails were not in 
the Secretary's 55,000-page production. OIG also learned that the 55,000-page production did 


* OIG sent 23 questionnaires to Secretary Rice's former staff and received 9 responses. Only one respondent reported 
using personal email accounts to conduct official business when "Department accounts were down or inaccessible." 
Two respondents said they printed emails and filed them into the Department's records systems; another said he 
believed IRM "backed up" all emails. One respondent stated she did not recall any specific instructions about 
retaining emails but assumed all emails were captured electronically. 

” Letter from Cheryl Mills, cdmills Group, to Patrick F. Kennedy, Under Secretary of State for Management (December 
5, 2014). 

5 FAM 443.3 (October 30, 1995). 
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not contain some emails that an external contact not employed by the Department sent to 
Secretary Clinton regarding Department business. In an attempt to address these deficiencies, 
NARA requested that the Department inquire with Secretary Clinton's "internet service or email 
provider" to determine whether it is still possible to retrieve the email records that might remain 
on its servers.” The Department conveyed this request to Secretary Clinton’s representative and 
on November 6, 2015, the Under Secretary for Management reported to NARA that the 
representative responded as follows: 

With regard to her tenure as Secretary of State, former Secretary Clinton has provided 
the Department on December 5, 2014, with all federal e-mail records in her custody, 
regardless of their format or the domain on which they were stored or created, that may 
not otherwise be preserved, to our knowledge, in the Department's recordkeeping 
system. She does not have custody of e-mails sent or received during the first few weeks 
of her tenure as she was transitioning to a new address, and we have been unable to 
obtain these. In the event we do, we will immediately provide the Department with 
federal record e-mails in this collection. 

With regard to Secretary Clinton's immediate staff, OIG received limited responses to its 
questionnaires, though two of Secretary Clinton's staff acknowledged occasional use of personal 
email accounts for official business.^' However, OIG learned of extensive use of personal email 
accounts by four immediate staff members (none of whom responded to the questionnaire). 
During the summer of 2015, their representatives produced Federal records in response to a 
request from the Department, portions of which included material sent and received via their 
personal email accounts.“^ The material consists of nearly 72,000 pages in hard copy and more 
than 7.5 gigabytes of electronic data. One of the staff submitted 9,585 emails spanning January 
22, 2009, to February 24, 2013, averaging 9 emails per workday sent on a personal email 
account. In this material, there are instances where the four individuals sent or received emails 


* Letter from Paul M. Wester, Jr, Chief Records Officer for the U.S. Government, NARA, to Margaret P. Grafeld, 

Deputy Assistant Secretary for Global Information Systems, Bureau of Administration, U.S. Department of State (July 2, 

2015). 

Letter from Patrick F. Kennedy, Under Secretary of State for Management to Laurence Brewer, Acting Chief 
Records Officer for the U.S. Government NARA (November 6, 2015). 

OIG sent 26 questionnaires to Secretary Clinton's staff and received 5 responses. Three respondents reported that 
they did not use personal email accounts to conduct official business. Another reported occasionally using persona! 
email accounts while traveling with the Secretary and when Department accounts were not working. Another said he 
occasionally used his persona! laptop or desktop at home to access the Department's OpenNet and that he assumed 
all data processed on OpenNet would be available to the Department. 

The material was produced to the Department for the following individuals: 

Title Production Dates 

Counselor and Chief of Staff 6/25/2015; 8/10/2015; 8/12/2015 

Deputy Chief of Staff for Operations 7/9/2015; 8/7/2015 

Deputy Chief of Staff/Director of Policy Planning 7/30/2015 

Deputy Assistant Secretary, Strategic Communications 7/28/2015; 8/6/15 
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regarding Department business using only their personal web-based email accounts. 
Accordingly, these staff failed to comply with Department policies intended to implement NARA 
regulations, because none of these emails were preserved in Department recordkeeping systems 
prior to their production in 2015,“^ As noted above, NARA has concluded that these subsequent 
productions mitigated their failure to properly preserve emails that qualified as Federal records 
during their service as Department employees. However, DIG did not attempt to determine 
whether these productions were complete. None of these individuals are currently employed by 
the Department, 

Secretary Kerry (February 1, 2013 - Present): Secretary Kerry uses a Department email account 
on OpenNet and stated that, while he has used a personal email account to conduct official 
business, he has done so infrequently. In his interview with OIG, Secretary Kerry stated that he 
used his personal email more frequently when he was transitioning from the U.S. Senate to the 
Office of the Secretary, However, after discussions with his aides and other Department staff, he 
began primarily using his Department email account to conduct official business. The Secretary 
stated he may occasionally use personal email for official business when responding to a sender 
who emailed him on his personai account. The Secretary also stated that he either copies or 
forwards such emails to his Department account and copies his assistant. OIG's limited review of 
electronic records shows some personal email account usage by Secretary Kerry. Secretary 
Kerry's emails are now being retained using the Capstone approach discussed previously, which 
complies with the Federal Records Act and email records management requirements.**’'' 

OIG received responses to questionnaires from most of Secretary Kerry's immediate staff, who 
reported occasional use of personal email accounts for official business. A number of staff 
also reported that they follow current policy on forwarding emails containing Federal records 
from personal accounts to Department accounts."’® OIG's limited review of electronic records 
shows some personal email account usage by these staff. 

Other staff reported that their emails are being retained using the Capstone approach, and 
some mentioned preserving emails through printing and filing. Several staff mentioned 
preserving emails by saving them in their Department email accounts. However, as previously 


36 C.F.R. §1236.22(d) (October 2, 2009); 5 FAM 443.3 (October 30, 1995). 

NARA, Guidance on a New Approach to Managing Email Records, Bulletin No. 2013-02 (August 29, 2013), available 
at https://www.archives.gov/records-mgrnt/bulletins/2013/2013-02.htmt. 

OIG sent 36 questionnaires to Secretary Kerry's staff and received 30 responses (several of the non- respondents 
had departed or were departing the Office of the Secretary), as well as a completed questionnaire from Secretary 
Kerry. With regard to preservation of Department emails, many reported retaining files in Microsoft Outlook and 
others reported that the Department was permanently retairring their email as part of the new Capstone program for 
senior officials. Most staff reported receiving training or other guidance on records preservation requirements 
through a variety of means, including formal training sessions, briefings, memos, and Department notices. Eleven staff 
reported using personal email accounts or other devices for official business, usually because of Internet connectivity 
interruptions while traveling. 

Eight stated that they forwarded or copied these emails to their Department accounts for records preservation 
purposes. 
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noted, NARA regulations state that agencies may only use an electronic mail system to store the 
recordkeeping copy of electronic mail messages identified as Federal records if that system 
contains specific features;“^ the current Department email system does not contain these 
features. Given that the Office of the Secretary does not use the SMART system, staff whose 
emails are not being retained under the Capstone approach should still be preserving emails 
through printing and filing. However, as previously noted, the Department is in the process of 
adopting a new email records management system that will cover the Office of the Secretary 
with the goal of meeting the requirement to manage all email records in an electronic format by 
December 31, 2016.“® The Department plans that this system will eventually capture some of 
the email currently saved in Department email accounts and all of the email of senior officials 
currently being preserved. 

CYBERSECURITY RISKS RESULT FROM THE USE OF 
NON-DEPARTMENTAL SYSTEMS AND EMAIL ACCOUNTS 


In addition to complying with records management and preservation requirements, Department 
employees, including those in the Office of the Secretary, must comply with cybersecurity 
policies. Department information must be secure and protected from threats. 

DS and IRM are the two bureaus within the Department with primary responsibility for ensuring 
the security of Department electronic information.^® IRM is responsible for establishing effective 
information resource management planning and policies; ensuring the availability of information 
technology systems and operations; and approving development and administration of the 
Department's computer and information security programs and policies. DS is responsible for 
providing a safe and secure environment for the conduct of U.S. foreign policy, including 
personal, physical, and information security.”® 

According to DS and IRM officials. Department employees must use agency-authorized 
information systems to conduct normal day-to-day operations because the use of non- 
Departmental systems creates significant security risks. Department policies have evolved 
considerably over the past two decades; but since 1996, the FAM and FAH have contained 
numerous provisions regulating the use of such outside systems, including computers, personal 
devices, Internet connections, and email. (See Appendix A for a compilation of related 
cybersecurity laws and policies that were in effect during the tenures of each Secretary, from 
Secretary Albright through Secretary Kerry.) These provisions do contemplate limited use of 
non-Departmental systems, but the exceptions are quite narrow. Among the risks is the 


36 C.F.R. § 1236.22 (October 2, 2009). 

™ 0MB and NARA, Memorandum far The Heads of executive Departments and Agencies and Independent Agencies: 
Managing Government Records Directive (0MB Memorandum M-12-18) (August 24, 2012). 

1 FAM 271.1(4) (March 5, 2010). 

12 FAM 010 (December 21, 2004). 
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targeting and penetration of the personal email accounts of Department employees, which was 
brought to the attention of the most senior officials of the Department as early as 2011/^* 
Another significant risk is the introduction of viruses and malware onto Department systems, 
which Increases their vulnerability to intrusion. 

Based on this evaluation and a previous OIG inspection, OIG identified three Department 
officials— Secretary Powell, Secretary Clinton, and a former U.S. Ambassador to Kenya— who 
exclusively used non-Departmental systems to conduct official business. As will be discussed in 
greater detail below, OIG acknowledges significant differences in the facts and circumstances 
surrounding each of these cases. 

Employees Generally Must Use Department Information Systems To Conduct 
Official Business 

The Department's current policy, implemented in 2005, is that normal day-to-day operations 
should be conducted on an authorized Automated Information System (AIS), which "has the 
proper level of security control to ... ensure confidentiality, integrity, and availability of the 
resident information."^^^ The FAM defines an AIS as an assembly of hardware, software, and 
firmware used to electronically input, process, store, and/or output data,“^ Examples include: 
mainframes, servers, desktop workstations, and mobile devices (such as laptops, e-readers, 
smartphones, and tablets). 

This policy comports with FISMA, which was enacted in December 2002 and requires Federal 
agencies to ensure information security for the systems that support the agency's operations 
and assets, including information security protections for information systems used by a 
contractor of an agency or other organization on behalf of an agency. FISMA defines 
information security as protecting information and information systems from unauthorized 
access, use, disclosure, disruption, modification, or destruction in order to provide for the 
integrity, confidentiality, and availability of the information and systems.*** In 2006, as required 
by FISMA, NIST promulgated minimum security requirements that apply to all information 
within the Federal Government and to Federal information systems.*** Among these are 
requirements for certifying and accrediting information systems, retaining system audit records 
for monitoring purposes, conducting risk assessments, and ensuring the protection of 
communications. 


*** See, eg., 11 STATE 65111 (June 28, 2011). 

*** 12 FAM 544,3 (November 4, 2005). This provision also states that "The Department’s authorized telework 
solution(s) are designed in a manner that meet these requirements and are not considered end points outside of the 
Department’s management control." 

*** 12 FAM 091 (January 11, 2016). 

“44U.S.C 5 3554. 

“ 44 U.S.C. § 3552(b)(3). 

NIST, FIPS PUB 200: Minimum Security Requirements for Federal Information and Information Systems [Uarcit 
2006). 
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In 2007, the Department adopted additional policies to implement these requirements, 
including numerous provisions intended to ensure that non-Departmental information systems 
that process or store Department information maintain the same minimum security controls. 
Further, non-Departmental systems that are sponsored by the Department to process 
information on its behalf must be registered vxith the Department.”’ 

Restrictions Apply to the Use of Non-Departmental Systems 

The FAM and FAH contain a number of restrictions regarding the use of non-Departmental 
computers, mobile devices, Internet connections, and personal email to transmit Department 
information. These provisions have evolved since 1996, but employees must implement 
safeguards or request approval before using such equipment. Figure 2 shows the evolution of 
these provisions and related statutes and regulations. 


5 FAH-11 H-412.4(c)(4) (June 25, 2007). 
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Figure 2: Timeline of Selected Security Requirements and Policies 


1987 


Computer Security Act requires agertcies to 
develop computer security plans and conduct 
security training. 


2001-2005 Coiin Powell 


2002 

FISMA requires that all information systems that 
process or store agency information be certified and 
accredited according to NIST standards. 

FAM requires alt Departnient facilittes to use 
OpenNet to access the Ii\ternet or request a waiver. 

2004 

FAM requires permission for Department offices to 
use commercial Internet service providers. 


1996 



FAM prohibits installation or use of privately owned 
computers in Department facilities. 


1997-2001 Madeleine Albright 


2000 

OMB Circular A-1.?0 required Federal agencies to 
establish information security programs containing 
specified elements, including development of a 
security plan and security controls. 


2005-2009 Condoieezza Rice 


2005 

FAM states- It is the Department's cjeneral policy 
that normal day-to-day operations be conducted on 
an authorized AIS, which fias tfie proper level of 
security control to provide nonrepudiation, 
authentication and encryption, to ensure 
confidentiality, irttegrify. and availability of tfie 
resident information ' 


2009-2013 Hillary Clinton 


FAM allows SBU information to be sent over the 
Internet with caution 


2009 

FAM prohibits use of personal digital assistants 
(PDAs) in Department facilities except for strictly 
unclassified areas 



Department begins Cyber Security Incident Program. 

2008 

FAM requires administrative, technical, and 
physical safeguards for the remote processing 
of SBU information 


2013-Present John Kerry 



FAM amended to allow use or installation of 
j.irivately owned computers only witli DS and 
IRM approval 


2015 

PDA restrictions moved to FAH and somewhat 
eased; requirement to use authorized AIS for 
day to day operations added to FAH. 


Source: OIG analysis of laws and policies. 
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Privately Owned Computers and Mobile Devices: In 1996, the FAM directed Department 
systems managers to ensure that privately owned computers were not installed or used in any 
Department office building.^ in 2008, the Department amended this provision to prohibit the 
use or installation of non-U.S. Government-owned computers in any Department facility without 
the written approval of DS and IRM, with certain exceptions,”^ 

In 2009, the Department adopted polices addressing the specific requirements for use of non- 
Department-owned personal digital assistants (PDAs).^ Under this policy, PDAs could only be 
turned on and used within Department areas that are strictly unclassified (such as the cafeteria) 
and could not connect with a Department network except via a Department-approved remote- 
access program, such as Global OpenNet.“‘ In 2014, the Department amended this provision to 
authorize Department managers in domestic locations to allow non-Department-owned PDAs 
within their specific work areas, provided users maintain a minimum 10-foot separation between 
the PDA and classified processing equipment. In 2015, the Department replaced these 
provisions with a new FAH provision that included the domestic lO-foot-separation rule and the 
ban on connecting to a Department network except via a Department-approved remote-access 
program.”^ 

Related to these provisions is the Department policy on "remote processing" — the processing of 
Department unclassified or sensitive but unclassified (SBU) information on non-Department- 
owned systems (such as a home computer or a tablet) or on Department-owned systems (such 
as a Department-issued laptop) at non-Departmental facilities (such as at an employee's home 
or a hotel) — ^which has been in place since 2008.”^ Under this policy, management and 
employees must exercise "particular care and judgment" when remotely processing SBU 
information.'^'' Offices that allow employees to remotely process SBU information must ensure 
that appropriate administrative, technical, and physical safeguards are maintained to protect the 


12 FAM 625.2-1 (April 12, 1996). 

12 FAM 625.2-1 (July 28, 2008). This provision was removed from the FAM in 2015, but a FAH provision prohibits 
the installation of non-Department owned information systems within Department facilities without the written 
authorization of DS and IRM. 12 FAH~10 H-112.14-2 (September 19, 2014). Both the FAM and FAH provisions include 
an exception for a non-Department entity that has an approved dedicated space within a Department facility. 

The FAM defined PDAs as "hand-heid computers" including "standard persona! digital assistants: e.g., Palm 
devices. Win CF devices, etc., and multi-function automated information system (AIS) devices; e.g., BlackBerry devices, 
PDA/cell phones, etc." 12 FAM 683.1 (December 2. 2009). 

12 FAM 683.2-3 (December 2, 2009). 

12 FAH-10 H-165.4 (May 20, 2015). These devices are referred to as Non-Department Owned Mobile Devices 
(NOOMDs). 

12 FAM 682 (August 4, 2008), This subchapter was later removed from the FAM and moved to the FAH at 12 FAH- 
10 H-170 (as amended January 11, 2016). 

“ 12 FAM 682.2-4 (August 4, 2008). This requirement is currently located at 12 FAH-10 H-173.4 (January 11, 2016). 
SBU information Is defined in the FAM as information that is not classified for national security reasons but that 
warrants or requires administrative control and protection from public or other unauthorized disclosure for other 
reasons. Examples include personnel data, visa and asylum records, law enforcement information, privileged 
communications, and deliberative inter- or intra-agency communications. 12 FAM 541 (March S, 2013). 
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confidentiality and integrity of records and to ensure encryption of SBU information with 
products certified by NIST. Employees must implement and regularly update basic home 
security controls, including a firewall, anti-spyware, antivirus, and file-destruction applications for 
ail computers on the network. In 2014, the Department added a provision to the FAH to 
require users who process SBU information on non-Department-owned storage media to 
encrypt It with products certified by NIST. 

Internet Connections: Since the end of 2002, the FAM has required all Department facilities to 
use the Department's primary Internet connection, OpenNet to establish Internet 
connectivity. The Department further regulated access to the Internet by establishing rules in 
2004 addressing the use of non-Departmental Internet connections in Department facilities.*^* 

Personal Email: Since 2002, Department employees have been prohibited from auto-forwarding 
their email to a personal email address "to preclude inadvertent transmission of SBU email on 
the Internet"*** 

The FAM also reminds employees that "transmissions from the Department's OpenNet to and 
from non-U.S. Government Internet addresses, and other .gov or .mil addresses, unless 
specifically directed through an approved secure means, traverse the Internet unencrypted."*” 
The FAM further states that, with regard to SBU information, the Department is expected to 
provide, and employees are expected to use, approved secure methods to transmit such 
information when available and practical. However, if such secure methods are not available, 
employees with a valid business need may transmit SBU information over the Internet 
unencrypted so long as they carefully consider that unencrypted emails can pass through 
foreign and domestic controlled ISPs, placing the confidentiality and integrity of the information 
at risk. In addition, the FAM instructs employees transmitting SBU information outside the 


12 FAM 682.2-5 (August 4, 2008). Currently, these requirements, as amended, are located at 12 FAH-10 H- 173.4 
(January 11, 2016). The amended provision requires NIST FIPS 140-2 encryption for SBU information in addition to the 
use of a firewall anti-spyware, anti-virus, and file destruction applications. 

12 FAH-10 H-172.1 (September 25, 2014). Currently, this requirement is located at 12 FAH-10 H-173.4 (January 11, 
2016). If the employee has a wireless home network, the FAH requires use of a NIST-validated product to secure the 
wireless connection. 12 FAH-10 H-173.4(9) (September 25, 2014). 

5 FAM 871 (December 30, 2002). The language of this provision was amended in 2004, 2009, and 2013, but the 
basic requirement to use OpenNet has remained consistent. 

5 FAM 874.2 (May 4, 2004). Currently, these rules are at 5 FAM 872 (May 1, 2014). Department facilities must seek 
authorization from the bureau Executive Director or post Management Officer to use such a connection. 5 FAM 872.1 
(May 1, 2014). Such systems may not be used to process SBU information, except in limited amounts under exigent 
circumstances. 5 FAM 872.2 (May 1, 2014). 

5 FAM 751.2 (February 27, 2002). This rule was amended in 2011 to Incorporate a prohibition on including a 
personal email address in an auto-reply message. 5 FAM 752.1(e) (November 14, 2011). 

12 FAM 544.3 (November 4, 2005). From 2002 to 2005, transmission of SBU information over the Internet was 
completely prohibited. 5 FAM 751.2 (February 27, 2002). 
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Department's OpenNet network on a regular basis to the same official or personal email address 
to request a solution from 

In 2015, the Department amended the FAM to incorporate NARA's guidance, which advises 
employees that "personal accounts should only be used in exceptional circumstances."^^^ This 
provision also states that "Department employees are discouraged from using private email 
accounts (e.g., Gmail, AOL, Hotmail, etc.) for official business [except] in those very limited 
circumstances when it becomes necessary to do so." However, the FAM gives no further 
guidance about what type of circumstances would permit use of personal email. 

The Department Has Issued Numerous Warnings About Cybersecurity Risks 

One of the primary reasons that Department policy requires the use of Department systems is to 
guard against cybersecurity incidents. Threats and actual attacks against the Department have 
been on the rise for nearly a decade. For example, in May 2006, the Department experienced 
large-scale computer intrusions that targeted its headquarters and its East Asian posts, 
Consequently, the Department has issued numerous announcements, cables, training 
requirements, and memos to highlight the various restrictions and risks associated with the use 
of non-Departmentai systems, especially the use of personal email accounts. 

As early as 2004, Department cables reminded staff that only Department-approved software 
should be installed on the Department’s information systems because outside software may 
bypass firewall and anti-virus checks, creating an open channel for hackers and malicious code, 
thus placing Department networks at serious risk.^^ Since then, the Department has published 
prohibitions or warnings related to the use of instant messaging, PDAs and smartphones, thumb 
drives, CDs and DVDs, Internet browsers, and personally owned devices.“^ Employees are also 
reminded of these issues through the Department's required annual Cybersecurity Awareness 
course.^^® Further, in 2005 OS's Cyber Threat Analysis Division (CTAD) began issuing notices to 
Department computer users specifically highlighting cybersecurity threats. For example, CTAD's 


12 FAM 5‘(4.2 (November 4, 2005). 

“ 5 FAM 443.7 (October 23, 2015). 

See Cyber Insecurity: Hackers Are Penetrating Federal Systems And Critical Infrastructure: Hearing Before the 
House Committee on Homeland Security, Subcommittee On Emerging Threats, Cybersecurity And Science And 
Technology, 110th Congress (2007) (statement of Donald Reid, Senior Coordinator for Security Infrastructure, Bureau 
of Diplomatic Security, U.S. Department of State), at 13-15. 

04 STATE 204864 (September 22, 2004). 

See e.g., 05 STATE 096534 (May 2005); Prohibition Against Use of Privately Owned Software/Hardware on 
Department Automated Information Systems, Announcement No. 2006_01_074 (January 24, 2006); Use Of 
Undassified/SBU Thumb Drives, Announcement No. 2008_09_046 (September 9, 2008); Using PEDs Abroad, 
Announcement No. 200S_09_068 (September 12, 2008); Remote Accessing and Processing, Announcement No. 
2008„11_061 (November 14, 2008); 09 STATE 130999 (December 24, 2009); Use of NomDepartment Owned Persona! 
Digital Assistants (PDAs) and Smartphones in Department Facilities, Announcement No. 2010 10_1S0 (October 26, 
2010 ). 

“ 5 FAM 845 (July 12, 2013). 
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notices from 2005 to 2011 addressed BlackBerry security vulnerabilities, generally citing mobile 
devices as a weak link in computer networks. CTAD warned that BlackBerry devices must be 
configured in accordance with the Department's security guidelines. 

In July 2005, IRM introduced its BlackBerry service that provided domestic users access to their 
OpenNet email, calendar, and contacts. From the beginning, the BlackBerry servers were 
required to be configured in accordance with the current DS Information Technology Security 
Guide, which contains an extensive list of security settings that lock down the devices. These 
security standards continue to apply to current Department BlackBerry devices. 

In March 2009, after unsuccessful efforts to supply Secretary Clinton with a secure government 
smartphone, DS was informed that Secretary Clinton's staff had been asking to use BlackBerry 
devices inside classified areas. The Assistant Secretary of DS then sent a classified memorandum 
to Secretary Clinton's Chief of Staff that described the vulnerabilities associated with the use of 
BlackBerry devices and also noted the prohibition on the use of Blackberry devices in sensitive 
areas. According to a DS official, shortly after the memorandum was delivered. Secretary Clinton 
approached the Assistant Secretary and told him she "gets it." 

The use of personal email accounts to conduct official business has been a particular concern 
over the past several years. For example, on March 11, 2011, the Assistant Secretary for 
Diplomatic Security sent a memorandum on cybersecurity threats directly to Secretary 
Clinton.^’ A portion of the unclassified version of this memorandum states: 

Threat analysis by the DS cyber security team and related incident reports indicate a 
dramatic increase since January 2011 in attempts by [redacted] cyber actors to 
compromise the private home e-mail accounts of senior Department officials. ... 

Although the targets are unclassified, personal e-mail accounts, the likely objective is to 
compromise user accounts and thereby gain access to policy documents and personal 
information that could enable technical surveillance and possible blackmail. The personal 
e-mail of family members also is at risk. 

The memorandum included as an attachment "a snapshot of affected Department personnel," 
noting that many of the email account owners play major roles in forming diplomatic and 
economic policy. It concluded by noting, "We also urge Department users to minimize the use 


™ See, e.g., CTAD, Cyber Security Awareness {Wanh 3, 2011). 

Department of State, Blackberry Wireless PDA Use in the Department of State, Announcement No. 200S_07_018, 
July 7, 2005. This announcement also notes: "Personal Blackberry devices are not allowed." In September 2005, 
overseas posts were also authorized to procure, install, and operate their own BlackBerry Enterprise Server (BES) and 
BlackBerry devices. 05 STATE 172062 (September 2005). 

OIG asked DS if it had sent memoranda warning of similar risks to other Secretaries, but it could not find any 
similar examples. 

Spear phishing was one of the several types of threats included in the Memorandum. It is an attack on a single 
user or department within an organization, such as asking employees to update their username and passwords. Once 
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of personal web email for business, as some compromised home systems have been 
reconfigured by these actors to automatically forward copies of all composed emails to an 
undisclosed recipient." 

Following the March 2011 memorandum, DS cybersecurity staff conducted two cybersecurity 
briefings of S/ES staff, the Secretary's immediate staff, and Bureau of Public Affairs staff in April 
and May 2011. OIG discovered in Secretary Clinton's retired paper files a copy of the classified 
presentation used during the briefing. It contains material similar to the type provided in the 
March 11, 2011, memorandum. 

On June 28, 2011, the Department, in a cable entitled "Securing Personal E-mail Accounts" that 
was approved by the Assistant Secretary for Diplomatic Security and sent over Secretary 
Clinton's name to all diplomatic and consular posts, encouraged Department users "to check the 
security settings and change passwords of their home e-mail accounts because of recent 
targeting of personal email accounts by online adversaries."”^ The cable further elaborated that 
"recently, Google asserted that online adversaries are targeting the personal Gmail accounts of 
U.S, government employees. Although the company believes it has taken appropriate steps to 
remediate identified activity, users should exercise caution and follow best practices in order to 
protect personal e-mail and prevent the compromise of government and personal information." 
It then recommended best practices for Department users and their family members to follow, 
including "avoid conducting official Department business from your personal e-mail 
accounts."”^ 

Three Officials Exclusively Used Non-Departmental Systems for Day-to-Day 
Operations 

Cybersecurity risks demonstrate the need both for restrictions on the use of non-Departmental 
systems and for requirements to seek approval before using such systems. A senior IRM official 


hackers obtain this information, they can easily access entry into secured networks. Another example of spear 
phishing is asking users to click on a link, which deploys spyware. 

11 STATE 65111 (June 28, 2011). 

That portion of the cable reads in ftjl! as follows: 

3. What can you and your family members do? 

(a) Follow the personal e-mail guides posted on the Awareness site to change your password, to ensure that 
messages are not auto-forwarding to an unintended address, and to verify that other security settings are 
properly configured. 

(b) Beware of e-mail messages that include links to password reset web pages. These can be easily faked. 

(c) Create strong passwords for all of your online accounts, change them often, and never use the same 
password for more than one account. 

(d) Avoid conducting official Department business from your personal e-mail accounts. 

(e) Do not reveal your personal e-mail address In your work "Out of Office" message. 

(f) Do not auto-forward Department e-mail to personal e-mail accounts, which is prohibited by Department 
policy (12 FAM 544.3). 
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reported to OIG that many Department employees have requested to use non-Departmental 
systems to conduct business; examples include requests to use outside video conferencing 
systems and file sharing software. According to this official, the Department typically refuses 
such requests. For instance, in 2012, Department staff submitted a request to IRM to use an 
Internet-based teleconference service. In response, IRM cited the 2005 FAM provision (12 FAM 
544.3) requiring that normal day-to-day operations be conducted on an authorized AIS and 
further noted that the Department "expect[s] employees to use the tools provided by the 
Department to protect sensitive information from unauthorized access or disclosure" and only 
permits the use of non-Departmental systems "when absolutely necessary." Other employees 
have sought to use Dropbox, a cloud-based file hosting service, but IRM has blocked access to 
the site on OpenNet since 2011 because of the risk of unauthorized access to Department data. 
The senior IRM official told OIG that the Department seldom encounters "an 'absolutely 
necessary' condition that would lead to approval for non-emergency processing/transmission of 
Department work outside [the Department's] network." 

OIG identified many examples of staff using personal email accounts to conduct official 
business; however, OIG could only identify three cases where officials used non-Departmental 
systems on an exclusive basis for day-to-day operations. These include former Secretaries Powell 
and Clinton, as well as Jonathan Scott Gration, a former Ambassador to Kenya. Although the 
former Ambassador was not a member of the Office of the Secretary, the Department's 
response to his actions demonstrates how such usage is normally handled when Department 
cybersecurity officials become aware of it. The facts and circumstances surrounding each of 
these cases are discussed below: 

Secretary Powell: Secretary Powell has acknowledged using a personal email account from a 
commercial Internet provider, which he accessed on a "private line" in his Department office. He 
further stated that he had two computers at his desk: "a secure State Department machine ... 
used for secure material, and. ..a laptop [used] for email."“ Neither the Secretary nor his 
representative could recall whether Secretary Powell owned the laptop or whether the 
Department provided it to him. However, the Secretary characterized the use of the laptop as his 
"unclassified system," which was not connected to OpenNet. In his interview with OIG, Secretary 
Powell explained that, when he arrived at the Department, the email system in place only 
permitted communication among Department staff. He therefore requested that information 
technology staff install the private line so that he could use his personal account to communicate 
with people outside the Department,™ He described his email usage as "daily," though OIG was 
unable to determine how many emails he actually sent and received during his tenure. 


“ Meet the Press (NBC television broadcast September 6, 2015) (interview with Colin Powell), available at 
http://www.nbcnews.com/meet-the-press/meet-press-transcript-september-6-2015-n422606. 

Secretary Poweil also acknowledged using his personal account to communicate with Department employees. 
Meet the Press (NBC television broadcast September 6, 2015) (interview with Colin Powell). 
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Various DS and IRM staff told OIG that, before Secretary Powell arrived at the Department, 
employees did not have Internet connectivity on their desktop computers. The Department's 
Chief Information Officer (CIO) and Under Secretary for Management during Secretary Powell's 
tenure reported to OIG that they were aware of Secretary Powell's use of a persona! email 
account and also noted the Secretary's goal was to provide every Department employee with 
similar Internet and email capabilities at their desktops. The current CIO and Assistant Secretary 
for Diplomatic Security, who were Department employees during Secretary Powell's tenure, also 
were both aware of the Secretary's use of a personal email account and recall numerous 
discussions with senior staff throughout the Department about how to implement the 
Secretary's intent to provide all employees with Internet connectivity. 

However, it is not clear whether staff explicitly addressed restrictions on the use of non- 
Departmental systems with Secretary Powell. For example, at the beginning of Secretary Powell's 
tenure, the Department had an outright prohibition on both the installation of privately owned 
computers in Department facilities and the transmission of SBU information on the Internet.”* 

By 2002, the Department had established the requirement to connect to the Internet only on 
OpenNet.^'^ The CIO and Under Secretary for Management during Secretary's Powell's tenure 
reported to OIG that they believe that these issues were addressed, either by installing a firewall 
to protect the Secretary's Internet connection or providing the Secretary with a Department 
laptop. They also reported having multiple discussions with Secretary Powell about the 
Department's implementation of FISMA requirements. In contrast, current DS and IRM officials 
who worked at the Department during Secretary Powell's tenure are unsure about the exact 
configuration of Secretary Powell's systems and whether staff addressed applicable restrictions 
with the Secretary. However, they reported to OIG that the Department's technology and 
information security policies were very fluid during Secretary Powell's tenure and that the 
Department was not aware at the time of the magnitude of the security risks associated with 
information technology. 

Secretary Clinton: By Secretary Clinton's tenure, the Department's guidance was considerably 
more detailed and more sophisticated. Beginning in late 2005 and continuing through 2011, the 
Department revised the FAM and issued various memoranda specifically discussing the 
obligation to use Department systems in most circumstances and identifying the risks of not 
doing so. Secretary Clinton's cybersecurity practices accordingly must be evaluated in light of 
these more comprehensive directives. 

Secretary Clinton used mobile devices to conduct official business using the personal email 
account on her private server extensively, as illustrated by the 55,000 pages of material making 
up the approximately 30,000 emails she provided to the Department in December 2014. 
Throughout Secretary Clinton's tenure, the FAM stated that normal day-to-day operations 


12 FAM 625.2-1 (April 12, 1996): 5 FAM 751.2 (February 27, 2002), 
5 FAM 871 (December 30, 2002). 
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should be conducted on an authorized AIS/'’’ yet OIG found no evidence that the Secretary 
requested or obtained guidance or approval to conduct official business via a personal email 
account on her private server. According to the current CIO and Assistant Secretary for 
Diplomatic Security, Secretary Clinton had an obligation to discuss using her personal email 
account to conduct official business with their offices, who in turn would have attempted to 
provide her with approved and secured means that met her business needs. However, according 
to these officials, DS and IRM did not — and would not — approve her exclusive reliance on a 
personal email account to conduct Department business, because of the restrictions in the FAM 
and the security risks in doing so. 

During Secretary Clinton’s tenure, the FAM also instructed employees that they were expected 
to use approved, secure methods to transmit SBU information and that, if they needed to 
transmit SBU information outside the Department's OpenNet network on a regular basis to non- 
Departmental addresses, they should request a solution from IRM.“® However, OIG found no 
evidence that Secretary Clinton ever contacted IRM to request such a solution, despite the fact 
that emails exchanged on her personal account regularly contained information marked as SBU. 

Similarly, the FAM contained provisions requiring employees who process SBU information on 
their own devices to ensure that appropriate administrative, technical, and physical safeguards 
are maintained to protect the confidentiality and integrity of records and to ensure encryption 
of SBU information with products certified by NIST.“® With regard to encryption, Secretary 
Clinton's website states that "robust protections were put in place and additional upgrades and 
techniques employed over time as they became available, including consulting and employing 
third party experts."^® Although this report does not address the safety or security of her 
system, DS and IRM reported to OIG that Secretary Clinton never demonstrated to them that her 
private server or mobile device met minimum information security requirements specified by 
FISMA and the FAM. 

In addition to interviewing current and former officials in DS and IRM, OIG interviewed other 
senior Department officials with relevant knowledge who served under Secretary Clinton, 
including the Under Secretary for Management, who supervises both DS and IRM; current and 
former Executive Secretaries; and attorneys within the Office of the Legal Adviser. These officials 
all stated that they were not asked to approve or otherwise review the use of Secretary Clinton's 
server and that they had no knowledge of approval or review by other Department staff. These 
officials also stated that they were unaware of the scope or extent of Secretary Clinton's use of a 
personal email account, though many of them sent emails to the Secretary on this account. 
Secretary Clinton's Chief of Staff also testified before the House Select Committee on Benghazi 
that she was unaware of anyone being consulted about the Secretary's exclusive use of a 


12 FAIVl 544.3 {November 4, 2005). 

12 FAM 544.2 {Novembers 2005). 

12 FAM 682 (August 4, 2008). 

https://www.hiilarydinton.com/briefing/factsheets/20i5/07/13/email-facts/ {date last downloaded April 20, 2016). 
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personal email address.'^^ OIG did find evidence that various staff and senior officials 
throughout the Department had discussions related to the Secretary's use of non-Departmental 
systems, suggesting there was some awareness of Secretary Clinton's practices. For example: 

• In late-January 2009, in response to Secretary Clinton's desire to take her BlackBerry 
device into secure areas, her Chief of Staff discussed with senior officials in S/ES and with 
the Under Secretary for Management alternative solutions, such as setting up a separate 
stand-alone computer connected to the Internet for Secretary Clinton "to enable her to 
check her emails from her desk," The Under Secretary's response was "the stand-alone 
separate network PC is [a] great idea" and that it is “the best solution." According to the 
Department, no such computer was ever set up. 


• In November 2010, Secretary Clinton and her Deputy Chief of Staff for Operations 
discussed the fact that Secretary Clinton's emails to Department employees were not 
being received. The Deputy Chief of Staff emailed the Secretary that "we should talk 
about putting you on state email or releasing your email address to the department so 
you are not going to spam." In response, the Secretary wrote, "Let's get separate address 
or device but I don't want any risk of the personal being accessible." 


• In August 2011, the Executive Secretary, the Under Secretary for Management, and 
Secretary Clinton's Chief of Staff and Deputy Chief of Staff, in response to the Secretary's 
request, discussed via email providing her with a Department BlackBerry to replace her 
personal BlackBerry, which was malfunctioning, possibly because “her personal email 
server is down." The then-Executive Secretary informed staff of his intent to provide two 
devices for the Secretary to use: "one with an operating State Department email account 
(which would mask her identity, but which would also be subject to FOIA requests), and 
another which would just have phone and internet capability." In another email 
exchange, the Director of S/ES-IRM noted that an email account and address had already 


'“The pertinent testimony from the former Chief of Staff, who declined OIG's request for an interview, reads as 
follows: 

Q Was anyone consulted about Secretary Clinton exclusively using a personal email address for her work? 

A I don't recall that. If it did happen, I wasn't part of that process. But I don't believe there was a consultation 
around it, or at least there's not one that I'm aware of, maybe I should better answer that way based on my 
knowledge. 

Q So no private counsel? 

A Not that I'm aware of. 

Q Okay. The general counsel for the State Department? 

A Not that I'm aware of. 

Q Okay. Anybody from the National Archives? 

A Not that I'm aware of. But I can only speak to my knowledge, obviously. 

Q Sure. And anyone from the White House? 

A Not that I'm aware of. 

Secretary Clinton declined OIG's request for an interview. The former Deputy Chief of Staff for Operations has not 
responded to OIG's request for an interview. 
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been set up for the Secretary”^ and also stated that "you should be aware that any email 
would go through the Department's infrastructure and subject to FOIA searches."^^ 
However, the Secretary's Deputy Chief of Staff rejected the proposal to use two devices, 
stating that it "doesn't make a whole lot of sense." OIG found no evidence that the 
Secretary obtained a Department address or device after this discussion. 

• OIG identified two individuals who provided technical support to Secretary Clinton. The 
first, who was at one time an advisor to former President Clinton but was never a 
Department employee, registered the clintonemail.com domain name on January 13, 
2009.^“ The second, a Schedule C political appointee who worked in IRM as a Senior 
Advisor from May 2009 through February 2013, provided technical support for 
BlackBerry communications during the Secretary's 2008 campaign for President.*” OIG 
reviewed emails showing communications between Department staff and both 
individuals concerning operational issues affecting the Secretary's email and server from 
2010 through at least October 2012. For example, in December 2010, the Senior Advisor 
worked with S/ES-IRM and IRM staff to resolve issues affecting the ability of emails 
transmitted through the clintonemail.com domain used by Secretary Clinton to reach 
Department email addresses using the state.gov domain.*^® 


*** According to the Department, this account was only used by Secretary Clinton's staff to maintain an Outlook 
calendar. 

The former Director of S/ES-IRM declined OIG's request for an interview. 

*** The clintonemaii.com domain name was registered with Network Solutions Certificate Authority on January 13, 
2009 and identifies the advisor to former President Clinton as the registrant 

Schedule C appointments are those of a "confidential or policy-determining character" 5 C.F.R. § 6.2. 

*” Secretary Clinton's counsel advised OIG that the Senior Advisor "performed technology services for the Clinton 
family for which he was compensated" by check or wire transfer in varying amounts and various times between 2009 
and 2013. In addition, the Senior Advisor's direct supervisors in IRM from 2009 to 2013 told OIG they were unaware of 
his technical support of the Secretary's email system. While working at the Department, the Senior Advisor reported 
directly to the Deputy Chief Information Officer (DGO) for Operations, who in turn reported to the Chief Information 
Officer (CIO). The DCIO and CIO, who prepared and approved the Senior Advisor's annual evaluations, believed that 
the Senior Advisor's job functions were limited to supporting mobile computing issues across the entire Department 
They told OIG that while they were aware that the Senior Advisor had provided IT support to the Clinton Presidential 
campaign, they did not know he was providing ongoing support to the Secretary's email system during working 
hours. They also told OIG that they questioned whether he could support a private client during work hours, given his 
capacity as a full-time government employee. 

““ At that time, S/ES IRM staff met with the Senior Advisor, who accessed the Secretary's email system and looked at 
its logs. The issue was ultimately resolved and, on December 21, 2010, S/ES-IRM staff sent senior S/ES staffers an 
email describing the issue and summarizing the activities undertaken to resolve it On another occasion, the Senior 
Advisor met with staff within CTAD and received a briefing on cyber security risks facing the Department A third 
interaction took place on October 30, 2012, during the period when Hurricane Sandy disrupted power in the New 
York City area. An email exchange between Deputy Chief of Staff for Operations and another member of the 
Secretary's staff revealed that the server located in Secretary Clinton's New York residence was down. Thereafter, the 
Senior Advisor met with S/ES-IRM staff to ascertain whether the Department could provide support for the server. 
S/ES-IRM staff reported to OIG that they told the Senior Advisor they could not provide support because it was a 
private server. 
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• Two staff in S/ES-IRM reported to OIG that, in late 2010, they each discussed their 
concerns about Secretary Clinton's use of a personal email account in separate meetings 
with the then-Director of S/ES-IRM. In one meeting, one staff member raised concerns 
that information sent and received on Secretary Clinton's account could contain Federal 
records that needed to be preserved in order to satisfy Federal recordkeeping 
requirements. According to the staff member, the Director stated that the Secretary's 
personal system had been reviewed and approved by Department legal staff and that 
the matter was not to be discussed any further. As previously noted, OIG found no 
evidence that staff in the Office of the Legal Adviser reviewed or approved Secretary 
Clinton's personal system. According to the other S/ES-lRM staff member who raised 
concerns about the server, the Director stated that the mission of S/ES-IRM is to support 
the Secretary and instructed the staff never to speak of the Secretary's personal email 
system again. 

• On January 9, 2011, the non-Departmental advisor to President Clinton who provided 
technical support to the Clinton email system notified the Secretary's Deputy Chief of 
Staff for Operations that he had to shut down the server because he believed "someone 
was trying to hack us and while they did not get in i didnt [sic] want to let them have the 
chance to." Later that day, the advisor again wrote to the Deputy Chief of Staff for 
Operations, "We were attacked again so I shut [the server] down for a few min." On 
January 10, the Deputy Chief of Staff for Operations emailed the Chief of Staff and the 
Deputy Chief of Staff for Planning and instructed them not to email the Secretary 
"anything sensitive" and stated that she could "explain more in person."^®^ 

Ambassador Gration; Ambassador Gration served as the U.S. Ambassador to Kenya from mid- 
2011 through mid-2012. OIG first publicly reported on the activities of Ambassador Gration as 
part of its 2012 inspection of Embassy Nairobi.'®" Prior to the inspection, in June 2011, DS 
learned that the newly posted Ambassador had drafted and distributed a revised mission policy 
concerning communications security that authorized him and other mission personnel to use 
commercial email for daily communication of official government business. That prompted 
senior DS management and cybersecurity staff to email the Ambassador to advise him that DS 
was dispatching an experienced Regional Computer Security Officer to provide expertise and 


In another incident occurring on May 13, 2011, two of Secretary Clinton's immediate staff discussed via email the 
Secretary's concern that someone was "hacking into her email" after she received an email with a suspicious link. 
Several hours later, Secretary Clinton received an email from the personal account of then-Under Secretary of State 
for Political Affairs that also had a link to a suspect website. The next morning. Secretary Clinton replied to the email 
with the following message to the Under Secretary "Is this really from you? ! was worried about opening it!" 
Department policy requires employees to report cybersecurity incidents to IRM security officials when any improper 
cyber-security practice comes to their attention, 12 FAM 592.4 (January 10, 2007). Notification is required when a user 
suspects compromise of, among other things, a personalty owned device containing personally identifiable 
information. 12 FAM 682.2-6 (August 4, 2008). However, OIG found no evidence that the Secretary or her staff 
reported these incidents to computer security personnel or anyone else within the Department. 

ISP-I-12-38A (August 2012). 
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advice in establishing procedures for handling SBU information that adhered to Department 
standards for the processing of sensitive material. DS further noted that this visit would be 
"especially timely in the wake of recent headlines concerning a significant hacking effort 
directed against the private, web-based email accounts of dozens of senior USG officials, which 
has generated substantial concern from the Secretary, Deputy Secretary Steinberg, and other 
Department principals." Notwithstanding the Department's concerns, the Ambassador continued 
to use commercial email for official business. 

DS then notified the Ambassador via cable on July 20, 2011, that the FAM did not permit him to 
use non-government email for day-to-day operations. The cable stated in relevant part: 

The language in 12 FAM 544.3, which states that "it is the Department's general policy 
that normal day-to-day operations be conducted on an authorized [automated 
information system]" is purposely included to place employees on notice that if they are 
given a tool that provides an adequate level of security encryption, such as an OpenNet 
terminal ... or any other Department-supplied security mechanism that works in the 
given circumstance, they must use it. 12 FAM 544.3 goes on to say that in the absence of 
a Department-supplied security solution employees can send most SBU information 
unencrypted via the internet only when necessary, with the knowledge that the nature of 
the transmission lends itself to unauthorized access, however remote that chance might 
be. ... Given the threats that have emerged since 2005, especially in regard to phishing 
and spoofing of certain web-based email accounts, we cannot allow the proliferation of 
this practice beyond maintaining contact during emergencies. We are all working toward 
the same end — to protect the availability, integrity and confidentiality of Department 
information and systems, while recognizing that emergency situations may arise, 
particularly for our employees serving overseas. ... The Department is not aware of any 
exigent circumstances in Nairobi that would authorize a deviation from the requirement 
to use Department systems for official business. 

However, the Ambassador continued to use unauthorized systems to conduct official business. 
The Department subsequently initiated disciplinary proceedings against him for his failure to 
follow these directions and for several other infractions, but he resigned before any disciplinary 
measures were imposed. 

OIG could find no other instances where the Department initiated disciplinary procedures 
against a senior official for using non-Departmental systems for day-to-day operations. 
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CONCLUSION 


Longstanding, systemic weaknesses related to electronic records and communications have 
existed within the Office of the Secretary that go well beyond the tenure of any one Secretary of 
State. OIG recognizes that technology and Department policy have evolved considerably since 
Secretary Albright's tenure began in 1997. Nevertheless, the Department generally and the 
Office of the Secretary in particular have been slow to recognize and to manage effectively the 
legal requirements and cybersecurity risks associated with electronic data communications, 
particularly as those risks pertain to its most senior leadership. OIG expects that its 
recommendations will move the Department steps closer to meaningfully addressing these risks. 


ESP-16-03 


UNCLASSIHED 


42 




202 


UNCIASSIHED 


RECOMMENDATIONS 


To ensure compliance with Federal and Department requirements regarding records 
preservation and use of non-Departmental systems, DIG has issued the following 
recommendations to the Bureau of Administration, the Office of the Secretary, the Bureau of 
Information Resources Management, the Bureau of Human Resources, and the Department’s 
Transparency Coordinator. Their complete responses can be found in Appendix B. The Department 
also provided technical comments that OIG incorporated as appropriate into this report. 

Recommendation 1: The Bureau of Administration should 

• continue to issue guidance, including periodic, regular notices, to Department 
employees to remind them that the use of personal email accounts to conduct official 
business is discouraged in most circumstances, 

• clarify and give specific examples of the types of limited circumstances in which such use 
would be permissible, and 

• instruct employees how to preserve Federal records when using personal email accounts. 

Management Response: In its May 23, 2016, response, the Bureau of Administration concurred 
with this recommendation. It will continue to issue guidance on records management practices 
and policies, and will ensure that this guidance explicitly reminds employees that the use of 
personal emails accounts to conduct official business is discouraged. 

OIG Reply: OIG considers the recommendation resolved. The recommendation can be closed 
when OIG receives and accepts documentation of this additional guidance. 

Recommendation 2; The Bureau of Administration should amend the Foreign Affairs Manual to 
reflect the updates to Department recordkeeping systems that provide alternatives to print and 
file emails that constitute Federal records. 

Management Response: In its May 23, 2016, response, the Bureau of Administration concurred 
with this recommendation. It noted that it is currently working with the Transparency 
Coordinator to update sections of the FAM related to the Department's recordkeeping/retention 
schedules, with a goal to eliminate the practice of print and file as the Department's policy for 
the retention of emails by December 31, 2016. 

OIG Reply; OIG considers the recommendation resolved. The recommendation can be closed 
when OIG receives and accepts documentation of the amendment 

Recommendation 3: The Office of the Secretary, Executive Secretariat, should work with the 
Office of Information Programs and Services to conduct an inventory of all electronic and hard- 
copy files in its custody and evaluate them to determine which files should be transferred to the 
Office of Information Programs and Services in accordance with records disposition schedules or 
Department email preservation requirements. 
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Management Response: In its May 16, 2016, response, the Executive Secretariat concurred with 
this recommendation. It noted that the inventory of electronic and hard copy files has been 
ongoing since January 2016 and that once it is complete, the Executive Secretariat will retire all 
such records according to applicable records schedules. 

OIG Reply: OIG considers the recommendation resolved. The recommendation can be closed 
when OIG receives and accepts documentation that this effort has been completed. 

Recommendation 4: The Office of the Secretary, Executive Secretariat, should work with the 
Office of Information Programs and Services to improve policies and procedures to promote 
compliance by all employees within its purview, including the Secretary, with records 
management requirements. These policies should cover the retirement of records in accordance 
with records disposition schedules, preservation of email and other electronic records of 
departing officials, and training of employees on their records preservation responsibilities. 

Management Response; In its May 16, 2016, response, the Executive Secretariat concurred with 
this recommendation. It noted that it is committed to coordinating closely with the Office of 
Information Programs and Services to provide updated guidance and training to all staff. 

OIG Reply: OIG considers the recommendation resolved. The recommendation can be closed 
when OIG receives and accepts a copy of the policies and procedures. 

Recommendation 5: The Office of the Secretary, Executive Secretariat, should work with the 
Office of Information Programs and Services to ensure that all departing officials within its 
purview, including the Secretary of State, sign a separation form (DS-109) certifying that they 
have surrendered all Federal records and classified or administratively controlled documents. In 
addition, staff should ensure that all incoming officials within its purview, including the 
Secretary, are thoroughly briefed on their records preservation and retention responsibilities, 
including records contained on personal email accounts. 

Management Response: In its May 16, 2016, response, the Executive Secretariat concurred with 
this recommendation. It noted that it is instituting a process whereby completed DS-109 forms 
are placed in the employee's permanent electronic performance files to ensure they are easily 
accessible. 

OIG Reply: OIG considers the recommendation resolved. The recommendation can be closed 
when OIG receives and accepts documentation of this process. 

Recommendation 6: The Department's Transparency Coordinator should work with the Office of 
Information Programs and Services to develop a quality assurance plan to promptly identify and 
address Department-wide vulnerabilities in the records preservation process, including lack of 
oversight and the broad inaccessibility of electronic records. 
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Management Response: In her May 16, 2016, response, the Transparency Coordinator concurred 
with this recommendation. She noted that this plan will be part of her continuing efforts, in 
coordination with the Office of Information Programs and Services and the Executive Secretariat, 
to improve overall governance of the Department's information, including how it is captured, 
stored, shared, disposed of, and archived. 

OIG Reply: OIG considers the recommendation resolved. The recommendation can be closed 
when OIG receives and accepts a copy of the quality assurance plan. 

Recommendation 7: The Bureau of Information Resource Management should 

• issue regular notices to remind Department employees of the risks associated with the 
use of non-Departmental systems; 

• provide periodic briefings on such risks to staff at all levels; and 

• evaluate the cost and feasibility of conducting regular audits of computer system usage 
to ascertain the degree to which Department employees are following the laws and 
policies concerning the use of personal email accounts. 

Management Response: In its May 23, 2016, response, the Bureau of Information Resource 
Management concurred with this recommendation. It noted that it will continue to issue regular 
notices regarding the risks associated with the use of non-Departmental systems. With regard to 
the evaluation of the cost and feasibility of regular computer system audits, the Bureau has 
considered such an effort but has concluded that audits conducted on such a wide scale would 
not be beneficial or feasible, especially because the Department already conducts continuous 
monitoring to ensure the integrity of the Department's networks and systems. 

OIG Reply: OIG considers the recommendation resolved. The recommendation can be closed 
when OIG receives and accepts documentation of additional educational efforts. 

Recommendation 8: The Director General of the Foreign Service and Director of Human 
Resources should amend the Foreign Affairs Manual to provide for administrative penalties for 
Department employees who (1) fail to comply with recordkeeping laws and regulations or (2) fail 
to comply with Department policy that only authorized information systems are to be used to 
conduct day-to-day operations. The amendment should include explicit steps employees should 
take if a reasonable suspicion exists that documents are not being preserved appropriately, 
including a reminder that the Office of Inspector General has jurisdiction to investigate and refer 
to appropriate authorities suspected violations of records preservation requirements. 

Management Response: In its May 23, 2016, response, the Department concurred with this 
recommendation. It will revise the FAM accordingly. The Department also noted that under 3 
FAM 4370, it currently has authority to discipline violations of any administrative regulations that 
do not provide a penalty. 
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OIG Reply; OIG considers the recommendation resolved. The recommendation can be closed 
when OIG receives and accepts documentation of the revision. 
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APPENDIX A; RELEVANT LAWS AND POLICIES DURING THE 
TENURES OF THE FIVE MOST RECENT SECRETARIES OF STATE 

Madeleine Albright (January 23. 1997 - January 20. 2001^ 

Foreign Affairs Manual if and Foreign Affairs HandbookifFM) Requirements for Use of 
Non-Departmental Systems; Since 1996, the FAM directed Department of State (Department) 
systems managers to ensure that privately owned computers were not installed or used in any 
Department office building.’ 

Applicable Cybereecurity Provisions and Related Guidance: In 1988, Congress enacted the 
Computer Security Act to require all Federal agencies to identify computer systems containing 
sensitive information, conduct computer security training, and develop computer security plans.^ 
Office of Management and Budget (0MB) Circular A-130 (Appendix HI) required Federal 
agencies to establish security programs containing specified elements, including development 
of a System Security Plan, assignment of responsibility for security to individuals knowledgeable 
in information security technology, and regular review of information system security controls. 
The FAM did not contain specific computer or cybersecurity provisions. 

Statutory and Regulatory Requirements for Email Records Preservation; The Federal Records Act 
of 1950 requires the head of every Federal agency to "make and preserve records containing 
adequate and proper documentation of the organization, functions, policies, decisions, 
procedures, and essential transactions of the agency."^ The agency head is also required to 
establish and maintain an active, continuing program for the economical and efficient 
management of agency records that provides for: 

• Effective controls over the creation and the maintenance and use of records in the 
conduct of current business; 

• Cooperation with the Archivist in applying standards, procedures, and techniques 
designed to improve the management of records, promote the maintenance and security 
of records deemed appropriate for preservation, and facilitate the segregation and 
disposal of records of temporary value; and 

• Compliance with Federal law and regulations.'* 

As part of this program, the agency head must establish safeguards against the removal or loss 
of records, including making it known to agency employees that agency records may not be 


' 12 FAM 625.2-1 (April 12, 1996). 

’ Pub. L. No. 100-235 (January 8, 1988). 

’ 44 U.S.C. § 3101. 

44 U.S.C. § 3102. 44 U.S.C. § 3102(3) specifically references "compliance with sections 2101-2117, 2501-2507, 2901- 
2909, and 3101-3107, of this title and the regulations issued under them." 
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unlawfully alienated or destroyed and that penalties exist for the unlawful removal or 
destruction of records.^ The agency head must notify the Archivist of any actual, impending, or 
threatened unlawrfu! removal, defacing, alteration, corruption, deletion, erasure, or other 
destruction of records in the agency's custody.® The Federal Records Act define records broadly as 

all books, papers, maps, photographs, machine readable materials, or other documentary 
materials, regardless of physical form or characteristics, made or received by an agency 
of the United States Government ... or in connection with the transaction of public 
business and preserved or appropriate for preservation by that agency or its legitimate 
successor as evidence of the organization, functions, policies, decisions, procedures, 
operations, or other activities of the Government or because of the informational value 
of data in them.' 

The regulations issued by the National Archives and Records Administration (NARA) in title 36 of 
the Code of Federal Regulations (C.F.R.) that were in effect during Secretary Albright's tenure 
specified actions that must be taken by an agency in establishing a records program. These 
included: 

• Assigning an office the responsibility for the development and implementation of 
agency-wide programs to identify, develop, issue, and periodically review recordkeeping 
requirements for records for all agency activities at all levels and locations in all media 
including paper, microform, audiovisual, cartographic, and electronic (including those 
created or received using electronic mail); 

• Integrating programs for the identification, development, issuance, and periodic review 
of recordkeeping requirements with other records and information resources 
management programs of the agency; 

• Issuing a directive establishing program objectives, responsibilities, and authorities for 
agency recordkeeping requirements; 

• Establishing procedures for the participation of records management officials in 
developing new or revised agency programs, processes, systems, and procedures in 
order to ensure that adequate recordkeeping requirements are established and 
implemented; 

• Ensuring that adequate training is provided to all agency personnel on policies, 
responsibilities, and techniques for the implementation of recordkeeping requirements 
and the distinction between records and non-record materials, regardless of media, 
including those materials created by individuals using computers to send or receive 
electronic mail; 


^ 44 U.S.C. § 3105. 

®44U.S.C.§3106. 

' 44 U.S.C. § 3301 (amended 2014). The regulations stated that the medium may be "paper, film, disk, or other 
physical type or form" and that the method of recording may be "manual, mechanical, photographic, electronic, or 
any other combination of these or other technologies." 36 C.F.R. § 1222.12(b)(2) (1990). 
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• Developing and implementing records schedules for all records created and received by 
the agency; 

• Reviewing recordkeeping requirements, as part of the periodic information resources 
management reviews; and 

• Reminding all employees annually of the agency's recordkeeping policies and of the 
sanctions provided for the unlawful removal or destruction of Federal records,* * * § 

The regulations explicitly noted that "messages created or received on electronic mail systems 
may meet the definition of record."* Furthermore, the regulations required agencies to develop 
procedures to ensure that departing officials do not remove Federal records from agency 
custody.** The regulations gave further guidance as to what constitutes a Federal record, 
specifying that records are those documents that: 

• Document the persons, places, things, or matters dealt with by the agency; 

• Facilitate action by agency officials and their successors in office; 

• Make possible a proper scrutiny by the Congress or other duly authorized agencies of 
the Government; 

• Protect the financial, legal, and other rights of the Government and of persons directly 
affected by the Government's actions; 

• Document the formulation and execution of basic policies and decisions and the taking of 
necessary actions, including all significant decisions and commitments reached orally; or 

• Document important board, committee, or staff meetings.** 

The regulations issued by NARA included separate provisions on electronic records 
management, including email. *^ The requirements for electronic records management largely 
matched those for general records management, but they did require integrating electronic 
records management with other records and information resources management and ensuring 
that adequate training is provided for users of electronic mail systems on recordkeeping 
requirements.** The management of email records had to include instructions on preservation of 
data regarding transmission, calendar and task lists, and acknowledgements. *'* Agencies were 
restricted from storing the recordkeeping copy of email messages solely on the electronic mail 


* 36 CF.R. 5 1222.20 (1995). 

® 36 C.F.R. § 1222,34(e) (1995). Even prior to the issuance of this provision, emails would have been considered a 
Federal record based on the broad definition of "record" in the Federal Records Act. 44 U.S.C. § 3301. 

“ 36 CF.R. S 1222.40 (1990), Even for non-records, the regulations permit removal only with the approval of the head 
of the agency or the individual authorized to act for the agency on matters pertaining to agency records. 36 C.F.R. 

§ 1222.42. 

** 36 C.F.R. § 1222.38 (1990). 

** 36 C.F.R. part 1234 (1995). 

** 36 C.F.R. § 1234.10 (1995). 

“ 36 C.F.R. § 1234.24(a) (1995). 
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system, unless the system was able to meet regulatory requirements.^^ If an agency used paper 
files as its recordkeeping system, it was required to print email records and the related 
transmission and receipt data,“ 

The regulations also noted that the use of external communications systems to which an agency 
has access, but which are neither owned nor controlled by the agency, does not alter in any way 
the agency's obligation under the Federal Records Act. Specifically, the regulations provided that 

agencies with access to external electronic mail systems shall ensure that Federal records 
sent or received on these systems are preserved in the appropriate recordkeeping 
system and that reasonable steps are taken to capture available transmission and receipt 
data needed by the agency for recordkeeping purposes.*^ 

The regulations also focused on the security of electronic records, requiring an effective records 
security program that ensures that only authorized personnel have access to electronic records; 
provides for backup and recovery of records; ensures that appropriate agency personnel are 
trained to safeguard sensitive or classified electronic records; minimizes the risk of unauthorized 
alteration or erasure of electronic records; and ensures that electronic records security is 
included in computer systems security plans.*® 

FAM and FAH Requirements for Email Records Preservation: The FAM largely mirrored the 
statutory requirements. It created a Records Management Program headed by the Chief of the 
Records Management Branch within the Bureau of Administration (A).*® The FAM required that 
all official files must remain in the custody of the Department and must be maintained in 
accordance with the Records Management Handbook, and it prohibited Department employees 
from improperly removing, retiring, transferring, or destroying Department records.®® The FAM 
noted that it is the responsibility of all Department employees and contractors to "make and 
preserve records containing adequate and proper documentation of the organization, functions, 
policies, decisions, procedures, and essential transactions of the Department."®* 

The FAM emphasized that "all employees must be aware that some of the variety of the 
messages being exchanged on E-mail are important to the Department and must be preserved; 
such messages are considered Federal records under the law.”®® It gave examples of emails that 
could constitute agency records, such as email providing key substantive comments on a draft 


“ 36 CF.R. 5 1234.24(b)(2) (1995). 

“ 36 C.F.R. 5 1234.24(d) (1995). 

36 C.F.R. § 1234.24(a)(4) (1995). 

“ 36 CF.R. S 1234.28 (1995). 

“ 5 FAM 413.1 (October 30, 1995). 

®“ 5 FAM 422.1 (October 30, 1995); 5 FAM 423.1 (October 30, 1995), 
5 FAM 413.10 (October 30, 1995). 

5 FAM 443.1(c) (October 30, 1995). 
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action memorandum; email providing documentation of significant Department decisions and 
commitments reached orally; and email conveying information of value on important 
Department activities, such as data on significant programs specially compiled by posts in 
response to a Department solicitation,^^ The FAM gave instructions on howto preserve email 
records, noting that 

until technology allowing archival capabilities for long-term electronic storage and 
retrieval of E-mail messages is available and installed, those messages warranting 
preservation as records (for periods longer than current E-mail systems routinely 
maintain them) must be printed out and filed with related records.^'* 

For departing employees, the FAM gave the administrative section of each office, bureau, or 
post the responsibility for reminding all employees who are about to leave the Department or 
the Foreign Service of the laws and regulations pertaining to the disposition of personal papers 
and official records; seeing that form OF-109, Separation Statement, is executed for each 
departing employee and is forwarded to the Office of Personnel for filing in the employee's 
Official Personnel Folder; and advising departing officials ranked Assistant Secretary and above, 
or Ambassador, to consult with the Department's Records Officer about depositing in the 
National Archives or a Presidential archival depository papers that they may have accumulated 
during their tenure and that may have historical interest.^® Form OF-109 required the employee 
to certify that "I have surrendered to responsible officials all unclassified documents and papers 
relating to the official business of the Government acquired by me while in the employ of the 
Department.” 

Other Preservation Guidance; On February 3, 1997, at the beginning of Secretary Albright's 
tenure, the Office of the Secretary's Executive Secretary sent a memorandum to all Assistant 
Secretaries on "Records Responsibilities and Reviews." The memorandum referred to a 
Department Notice on the subject, as well as the Federal Records Act and 5 FAM 443, which 
covered email records. The memorandum stated that information maintained in email may 
constitute a record if it meets the statutory definition of a record and stated, "You need not 
preserve every e-mail message. If a record in electronic media or electronic mail must be 
preserved, print the files or messages and place the paper record in the appropriate official file; 
or continue to maintain electronically if feasible." 

On July 28, 2000, a notice reminded all Department employees to preserve emails that qualify as 
records, stating that “those messages containing information that documents Departmental 


5 FAM 443.2(d) (October 30, 1995). 

5 FAM 443.3 (October 30, 1995). For emails considered records, the FAM required preserving the email message, 
any attachments, and transmission data such as sender, addressee, cc's, and the date and time sent. If the email 
system did not print this necessary data, employees were instructed to annotate the printed copies with that data. 
“ 5 FAM 413.9 (October 30, 1995). 
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policies, programs, and activities must be preserved in paper form." It instructed employees to 
print out such emails and file them with related paper records. 

In August 2000, the Bureau of Administration published a Briefing Booklet for Departing Officials 
on "Senior Officials and Government Records" that included a signed letter from the Secretary 
stating that records "must be preserved to enhance our national archives and to provide 
accurate and complete records." The Secretary also noted that "we [senior officials] have a 
special obligation as the officials who welcomed in a new century and technological era to 
preserve e-mail messages as federal records, as appropriate." 

A December 2000 cable to all ambassadors and administrative officers reminded departing 
officials to not remove any papers, whether personal or official, from the Department until such 
materials have been reviewed to ensure compliance with records laws and regulations.^® It noted 
that electronic records must be preserved by printing the files or messages and placing the 
paper record in the appropriate official file. 

Colin Powell (January 20. 2001 - January 26. 2005) 

FAM and FAH Requirements for Use of Non-Departmental Systems: Beginning in December 
2002, the FAM required all Department facilities to use the Department's primary Internet 
connection, OpenNet, to establish Internet connectivity.^^ OpenNet provided improved 
information management and heightened information security throughout the Department. If a 
bureau or post wanted an exception to this policy, it was required to request a waiver.^® 

The Department established rules in May 2004 regulating the use of non-government 
information systems, called Dedicated Internet Networks (DINs), to access the Internet.^® A DIN 
is a stand-alone information network, such as a local network or server, with dedicated Internet 
access provided by a commercial Internet service provider (ISP). DINs were not to be used to 
carry out Department business or to transmit sensitive but unclassified (SBU) information. All 
bureaus and posts were required to submit a waiver to request an exception in order to use a 
commercial Internet connection for a stand-alone local network or server. The request for a 
waiver needed to contain detailed information about the network or server, including an 
explanation of compliance with Department's standards and specific reasons why OpenNet did 
not meet the requester's official business requirements. The FAM required all waivers to be 
approved by the Department's Information Technology Change Control Board (IT CCB).^® 
According to the IT CCB, it approved approximately 180 such waivers during the first year this 
provision was in effect. 


00 STATE 228951. 

^ 5 FAM 871 (December 30, 2002). At the time, OpenNet was referred to as "OpenNet Plus." 
® S FAM 872 (December 30, 2002). 

5 FAM 874.2 (May 4, 2004). 

“S FAM 874.2 (May 4, 2004). 
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Applicable Cybersecurity Provisions and Related Guidance: The E-Government Act, signed into 
iaw in December 2002, recognized the importance of information security to the economic and 
national security interests of the United States. Title ni of the Act, the Federal Information Security 
Management Act (FISMA), gave the National Institute of Standards and Technology (NIST) 
responsibility to develop Federal Government information security standards and guidelines.^' 

Statutory and Regulatory Requirements for Email Records Preservation: The requirements in the 
Federal Records Act of 1950 and related regulations in title 36 of the C.F.R. did not change. 

FAM and FAN Requirements for Email Records Preservation: The requirements in the FAM 
generally had not changed from Secretary Albright’s tenure, However, in 2002, the Department 
added a section to the FAM on email usage that included a requirement that email users 
"determine the significance and value of information created on e-mail systems [and] determine 
the need to preserve those messages that qualify as records."” In 2004, the FAM was amended 
to designate the Director of the Office of Information Programs and Services (IPS) as the 
Department’s Records Officer.” This amendment also noted that "email sent or received as a 
Department official is not personal."” Finally, the amendment assigned the responsibilities related 
to departing officials, including ensuring the OF-109 was signed, to Management Officers, but 
eliminated the requirement that the OF-109 be filed in the employee's personnel folder.” 

Other Preservation Guidance: On August 9, 2004, the Executive Secretary sent a memorandum 
to all Under Secretaries and Assistant Secretaries entitled "Refresher on Records Responsibilities 
and Review." The memorandum stated that: 

Departing officials may not remove any documentary materials, whether personal or 
official and whether in written or electronic form, from the Department until they have 
been reviewed by records and security officers to ensure compliance with records laws 
and regulations, ... In addition, departing officials must ensure that all record material 
they possess is incorporated in the Department's official files. ... Finally, the 
administrative section of each office and bureau in the Department will ensure that 
departing officials receive a mandatory briefing and that ail departing officials will 
execute a Separation Statement (OF-109) certifying that they have not retained in their 
possession classified or administratively controlled documents. 


E-Government Act of 2002 (Pub. L. No. 107-347), Title in. Information Security, titled Federal Information Security 
Management Act of 2002, 116 STAT. 2946 (December 17, 2002). NIST did not promulgate guidance on minimum 
security requirements until March 2006. 

" 5 FAM 751.4 (February 27, 2002). 

” 5 FAM 414.2 (September 17, 2004). 

” 5 FAM 415.1 (September 17, 2004). 

® 5 FAM 414.7 (September 17, 2004). 
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In December 2004, NARA issued a bulletin to remind heads of Federal agencies that official 
records must remain in the custody of the agency and that they must notify officials and 
employees that there are criminal penalties for the unlawful removal or destruction of Federal 
records,^® Employees may remove extra copies of records or other work-related non-record 
materials when they leave the agency with the approval of a designated agency official such as 
the Records Officer or legal counsel. It also noted that "officials and employees must know how 
to ensure that records are incorporated into files or electronic recordkeeping systems, especially 
records that were generated electronically on personal computers." Further, the bulletin stated 
that, "in many cases, officials and employees intermingle their personal and official files. In those 
cases, the agency may need to review and approve the removal of personal material to ensure 
that all agency policies are properly followed." 

A January 2005 cable to all embassies, posts, and offices reminded them of their responsibilities 
to preserve records under the Federal Records Act and noted that responsibility for 
implementing and administering records policies and procedures is given to the Management 
Section of each Department office.^’ 

Condoleezza Rice (January 26, 2005 - January 20. 2009) 

FAM and FAH Requirements for Use of Non-Departmental Systems; In November 2005, the FAM 
listed the connection of prohibited hardware or electronic devices to a Department Automated 
Information System (AIS) as a cybersecurity violation.^® In 2007, the Department restated this 
provision to prohibit the connection of "unauthorized hardware/electronic devices to 
Department networks," which included non-Department-owned hardware/electronic devices.^® 

Also in November 2005, the Department adopted the policy that normal day-to-day Internet 
operations are to be conducted on an authorized AIS designed with the proper level of security 
control to provide authentication and encryption to ensure confidentiality and integrity for 
transmitting Departmental SBU data and information.* Employees with a valid business need 
may transmit SBU information over the Internet unencrypted so long as they carefully consider 
that unencrypted emails can pass through foreign and domestic controlled ISPs, putting the 
confidentiality and integrity of the information at risk. The FAM further specified that employees 
transmitting SBU information outside the Department's OpenNet network on a regular basis to 
the same non-Departmental email address should obtain a secure technical solution for those 
Internet transmissions from the Bureau of Information Resource Management (IRM)."* The FAM 


NARA, Protecting Federal records and other documentary materials from unauthorized removal, Bulletin No. 2005- 
03 (December 22, 2004). 

’’ 05 STATE 013345 (January 24, 2005). 

12 FAM 592.2 (November 1, 2005). 

” 12 FAM 592.2 (January 10, 2007). 

* 12 FAM 544.3 (November 4, 2005). 

12 FAM 544.2 (November 4, 2005). 
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noted that SBU information resident on personally owned computers Is generally more 
susceptible to cyber-attacks and/or compromise than information on government-owned 
computers connected to the Internet.''^ Ail employees who possessed SBU information on 
personally owned computers must ensure adequate and appropriate security for the SBU 
information.''^ 

In 2008, the Department amended the FAM to define "remote processing” as the processing of 
Department information on non-Department-owned systems at non-Departmental facilities.'” 
Offices that allow employees to remotely process SBU information must ensure that appropriate 
administrative, technical, and physical safeguards are maintained to protect the confidentiality 
and integrity of records.'’^ Employees are prohibited from storing or processing SBU Information 
on non-Department-owned computers unless it is necessary in the performance of their 
duties.'*^ Employees must (!) ensure that SBU information is encrypted; (2) destroy SBU 
information on their personally owned and managed computers and removable media when the 
files are no longer required; and (3) when using personally owned computers, implement and 
regularly update basic home security controls, including a firewall, anti-spyware, antivirus, and 
file-destruction applications, and if those computers are networked, also ensure the same basic 
controls, plus NIST-certified encryption, for all computers on the network.''^ 

Also in 2008, the Department eased the FAM restriction regarding the use or installation of non- 
Federal-Government-owned computers in any Department facility; such use was now allowed 
with the written approval of the Bureau of Diplomatic Security (DS) and IRM with certain 
exceptions.''® 

Applicable Cybersecurity Provisions and Related Guidance: The Department implemented the 
Cyber Security Incident Program (CSIP) in November 2005 to improve protection of the 
Department's unclassified/SBU cyber infrastructure by identifying, evaluating, and assigning 
responsibility for breaches of cybersecurity.''® CSIP focused on accountability of personnel for 
actions leading to damage or risk to Department information systems and infrastructure, even 
when only unclassified material or information is involved.™ Cybersecurity incidents are defined 
as acts against, or failure to protect, the Department's unclassified cyber infrastructure.®' 


'" 12 FAM 544.3 (November 4, 2005). 

® 12 FAM 544.3 (November 4, 2005). 

" 12 FAM 6S2.1 (August 4, 2008). 

12 FAM 682.2-4 (August 4, 2008). 

* 12 FAM 682.2-4 (August 4, 2008). 

12 FAM 682.2-5 (August 4, 2008). Although the FAM chapter relating to remote access and processing was 
amended in 2009, 2011, 2014, and 2015, these basic requirements did not change. 

12 FAM 625.2-1 (July 28, 2008). 

^ 12 FAM 591.1(a) (November 1, 2005). 

” 12 FAM 591.1 (November 1, 2005). 

“ 12 FAM 592 (January 10, 2007), 
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Reporting cybersecurity incidents is every employee's responsibility, and each employee must 
be familiar with the list of cybersecurity infractions and violations, Employees must inform their 
Information Systems Security Office and their Regional or Bureau Security Officer when any 
improper cybersecurity practice comes to their attention.^^ Improper security practices include 
personnel compromising the confidentiality of sensitive information, deliberate introduction of a 
malicious program code, and use of encryption to conceal an unauthorized act, such as the 
transfer of SBU information to an unauthorized individual,” 

NIST was tasked with responsibility to develop Federal standards and guidelines to implement 
FISMA, NIST responded in February 2004 with Federal Information Processing Standards (FIPS) 
Publication 199, Standards for Security Categorization of Federal Information and Information 
Systems, which established security categories for both information and information systems 
that are used in conjunction with vulnerability and threat information for assessing the risk to an 
organization,^^ This was followed in March 2006 by FIPS Publication 200, which specified 
minimum security requirements for information and information systems supporting Federal 
agencies. NIST's announcement of the publication of FIPS Publication 200 noted 

this standard is applicable to: (i) all information within the federal government other than 
that information that has been determined pursuant to Executive Order 12958, as 
amended by Executive Order 13292, or any predecessor order, or by the Atomic Energy 
Act of 1954, as amended, to require protection against unauthorized disclosure and is 
marked to indicate its classified status; and (ii) ail federal information systems other than 
those information systems designated as national security systems as defined in [44 
U.S.C. § 3552(b)(6)], 

Section 3 of FIPS 200 sets forth 17 specifications for minimum security requirements, including 
the following: 

• The Audit and Accountability specification states: "Organizations must (i) create, protect, 
and retain information system audit records to the extent needed to enable the 
monitoring, analysis, investigation, and reporting of unlawful, unauthorized, or 
inappropriate information system activity; and (ii) ensure that the actions of individual 
information system users can be uniquely traced to those users so they can be held 
accountable for their actions." 

• The Risk Assessment specification states: "Organizations must periodically assess the risk 
to organizational operations (including mission, functions, image, or reputation), 
organizational assets, and individuals, resulting from the operation of organizational 


“ 12 FAM 592.4 (January 10, 2007). 

12 FAM 592.4 (January 10, 2007). 

” 12 FAM 592.1 and 592.2 (January 10, 2007). 

” NIST, FIPS PUB 199: Standards for Security Categorization of Federal Information and Information Systems 
(February 2004). 
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information systems and the associated processing, storage, or transmission of 
organizational information.” 

• The System and Communications Protection specification states: "Organizations must (i) 
monitor, control, and protect organizational communications {i.e., information 
transmitted or received by organizational information systems) at the external 
boundaries and key internal boundaries of the information systems; and (ii) employ 
architectural designs, software development techniques, and systems engineering 
principles that promote effective information security within organizational information 
systems. 

Federal agencies were required to comply with these standards by March 2007.“ 

In 2007, the Department adopted rules implementing these FISMA requirements, including the 
requirement that non-Departmental information systems that process or store bureau- 
sponsored Department information on behalf of the Department maintain a baseline of 
minimum security controls to protect Department information and information systems.*^ Key 
personnel identified to perform certification and accreditation of non-Departmental systems 
must not be involved with its development, implementation, or operation, or be under the 
sponsoring bureau's direct management authority.^ 

DS reported to the Office of Inspector General that, in 2005, the Bureau of Intelligence and 
Research (INR) issued guidance permitting BlackBerry devices to be used inside secure areas. 
However, in January 2006, the Office of the Director of National Intelligence issued a clear 
prohibition on such use, and the INR guidance was immediately rescinded. 

Statutory and Regulatory Requirements for Email Records Preservation: The requirements in the 
Federal Records Act of 1950 had not changed. The records requirements in title 36 of the C.F.R. 
were also largely the same, except that, in 2006, NARA amended the regulations to allow 
agencies to store transitory email records (which have minimal or no documentary or evidential 
value) on an email system rather than requiring employees to print and file them or store them 
in a recordkeeping system, as long as the transitory records are maintained through the 
applicable NARA-approved retention period.^ 

FAM and FAH Requirements for Email Records Preservation: The requirements in the FAM 
generally had not changed. In 2005, the FAM was amended to include a reminder that "every 
Department of State employee must create and preserve records that properly and adequately 


“ NIST, FIPS PUB 200: Minimum Security Requirements for Federal Information and Information Systems (March 
2006). 

” 5 FAM 1065.1-6 (February 22, 2007); 5 FAH-11 H-411.4 (June 25, 2007). 

S FAH-11 H-411.5 (June 25, 2007). 

® 71 Fed, Reg. 8807 (February 21, 2006) (amending 36 CF.R. S 1234.24). NARA also amended 36 C.F.R. § 1234.32 to 
provide a NARA-approved disposition authority for transitory emails. 
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document the organization, functions, policies, decisions, procedures, and essential transactions 
of the Department,”® 

Other Preservation Guidance: A February 2005 cable drafted by the Bureau of Administration 
and sent over the Secretary's name to all embassies and posts and an announcement to all 
employees reminded departing officials not to remove any papers until they have been 
reviewed to ensure compliance with records laws and regulations.®^ 

In December 2005, NARA issued a bulletin that reminded agencies that all electronic records 
created and received by agencies are subject to the same existing statutory and regulatory 
records management requirements as records in other formats and on other media,®^ 

A February 2007 cable drafted by the Bureau of Administration and sent over the Secretary's 
name to all embassies and posts and an announcement to all employees were distributed to 
remind employees that, until the new State Messaging and Archive Retrieval Toolset (SMART) is 
implemented, email, Short Message Service messages, or instant messages that qualify as 
records must be printed and filed with related paper records, including any attachments and 
transmission data.®® 

In April, June, and October 2008, announcements to all employees again reminded departing 
employees not to remove any papers until they had been reviewed. They also stated that "e-mail 
messages must generally be printed out and filed with related paper records."®^ 

On January 15, 2009, the Under Secretary for Management issued a memorandum to all Under 
Secretaries, Assistant Secretaries, Executive Directors, and Post Management Officers on 
"Preserving Electronically the Email of Senior Officials upon their Departure." The memorandum 
required bureaus to copy the email accounts of senior departing officials onto CDs and deliver 
those CDs to IPS. The requirement was applicable to political appointees, not career staff, and 
was put in place to supplement the traditional print and file policy for record email. 

Hillary Clinton fJanuanr 21. 2009 - Feboiatv 1. 20131 


“ S FAM 422.3 (October 11, 2005). 

“ 05 STATE 018818; Department of State, Procedures for the Removal of Persona! Papers and Non-Record Material, 
Announcement No. 2005_02_017, February 3, 2005. 

NARA, NARA Guidance for Implementing Section 207(e} of the E-Government Act of 2002, Bulletin No. 2006-02 
(December 15, 2005). 

07 STATE 024044; Department of State, Records Management Procedures, Announcement No. 2007_02_147, 
February 28, 2007. 

“ Department of State, Departing Officials: Procedures for the Removal of Personal Papers and Non-Record Material, 
Announcement No. 2008_04_089, April 17, 2008; Department of State, Reminder - Departing Officials: Procedures for 
the Removal of Personal Papers and Non-Record Material, Announcement No. 2008_06_095, June 16, 2008; 
Department of State, Reminder - Departing Officials: Procedures for the Removal of Persona! Papers and Non-Record 
Material, Announcement No. 2008_10_087, October, 16, 2{X)8. 
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FAM and FAN Requirements for Use of Non-Departmental Systems; A December 2009 FAM 
provision states that non-Department-owned personal digital assistants (PDAs) may only be 
turned on and used within Department areas that are strictly unclassified (such as the cafeteria) 
and may not connect with a Department network except via a Department-approved remote- 
access program.® 

Applicable Cybersecurity Provisions and Related Guidance: To meet the requirements of FISMA, 
the Department implemented a mandatory annual requirement for all Department computer 
users to take Cybersecurity Awareness training.® 

Beginning in 2009, the Cyber Threat Analysis Division (CTAD) in DS issued regular notices to 
Department computer users highlighting cybersecurity threats. CTAD notices addressed 
BlackBerry security vulnerabilities, citing this device as a weak link in a computer network.® 
CTAD warned that BlackBerry devices must be configured in accordance with Department 
security guidelines. 

CTAD's concerns also included cybersecurity risks faced during international travel. According to 
an article posted by CTAD, digital threats begin immediately after landing in a foreign country. A 
primary threat is traced to the traveler's mobile device (BlackBerry or other smart device) which 
is necessarily connected to the local cellular tower. This connection gives foreign entities the 
opportunity to intercept voice and email transmissions immediately after the traveler arrives 
overseas.® 

The E-Government Act and NIST FIPS PUB 200 were unchanged. 

Statutory and Regulatory Requirements for Email Records Preservation: The requirements in the 
Federal Records Act of 1950 had not changed. In October 2009, NARA published a final rule that 
revised and reorganized its records management regulations.® The existing requirements were 
largely retained, but renumbered.’° New responsibilities were added to agencies' records 
program duties, including assigning records management responsibilities in each 
program/mission to ensure incorporation of recordkeeping requirements into agency 


“ 12 FAM 683.2-3 (December 2, 2009). 

“ 13 FAM 331 (December 22, 2010). 

® CTAD, Security Checklist {Oecemher IS, 2009): CTAD, Cyber Security Awareness [Uatch 3, 2011). 

How to manage cybersecurity risks of international travel (September 15, 2010) by (ISC)2 Government Advisory 
Board Executive Writers Bureau (posted by CTAD on January 26, 2011). 

® 74 Fed. Reg. 51004 (Oct 2, 2009). 

™ For example, the requirements of an agency records program were moved from 36 C.F.R. § 1222.20 to 36 C.F.R. I§ 
1220.30, 1220.32 and 1220.34. Requirements regarding departing officials were moved from 36 C.F.R, l§ 1222.40, 
1222.42 to 36 C.F.R. 5S 1222.18. 1222.24(a)(6). 
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programsJ* The new section on managing email records required preservation of email 
attachments that are an integral part of the record/^ It also stated: 

Agencies that allow employees to send and receive official electronic mail messages 
using a system not operated by the agency must ensure that Federal records sent or 
received on such systems are preserved in the appropriate agency recordkeeping 
system.’^ 

FAM and FAH Requirements for Email Records Presentation: The requirements in the FAM and 

FAH generally had not changed. 

Other Presentation Guidance: In June 2009, the Department sent an announcement regarding 
preservation of email messages,^'’ It reminded employees of the requirement to preserve email 
records, citing the FAM and C.F.R. provisions, and noted that, until SMART becomes available, 
employees must print and file emails that are Federal records. 

In November 2009, the Department sent a cable to all embassies and posts and an 
announcement to all employees reminding them that all Department employees have records 
management responsibilities.” It noted that Federal records can be found "in any media 
including e-mail, instant messages, social media, etc." 

On November 28, 2011, President Obama issued a memorandum to the heads of executive 
departments and agencies requiring them to submit a report to the Archivist and the Director of 
0MB that 

(i) describes the agency's current plans for improving or maintaining its records 
management program, particularly with respect to managing electronic records, 
including email and social media, deploying cloud based services or storage solutions, 
and meeting other records challenges; (ii) identifies any provisions, or omissions, in 
relevant statutes, regulations, or official NARA guidance that currently pose an obstacle 
to the agency's adoption of sound, cost effertive records management policies and 
practices: and (iii) identifies policies or programs that, if included in the Records 
Management Directive required by section 3 of this memorandum or adopted or 
implemented by NARA, would assist the agency's efforts to improve records 
management.” 

” 36 C.F.R. § 1220.34 (2010). 

” 36 C.F.R. § 1236.22(a)(2) (2010). 

” 36 C.F.R. 1 1236.22(b) (2010). 

” Department of State, Preserving Electronic Message (E-mail) Records, Announcement No. 2009_06 090, June 17, 
2009. 

” 09 STATE 120561; Department of State, Records Management Responsibilities Announcement No. 2009_11 J25, 
November 23, 2009. 

” Presidential Memorandum ~ Managing Government Records t)iiovetrloei 28, 2011). 
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In August 2012, 0MB and NARA issued a memorandum to the heads of executive departments, 
agencies, and independent agencies in part directing agencies to eliminate paper and use 
electronic recordkeeping. Per this memorandum, agencies will be required to manage all email 
records in an electronic format by December 31, 2016.” 

John Kerry ffebruary 1. 2013 - Present! 

FAM and FAH Requirements for Use of Non-Departmental Systems: On May 1, 2014, the 
Department amended the definition of a DIN to require the DIN to be on a Department-owned 
and operated discrete non-sensitive unclassified local area network that is not connected to any 
other Department system.™ In addition, the domestic approving authority for a DIN changed 
from the Department's IT CCB to the relevant bureau's Executive Director or equivalent.™ 

A September 2014 FAH provision stated that supervisors must exercise "particular care and 
judgment" in allowing users to remotely process SBU information and must advise users that all 
non-Department-owned storage media containing Department SBU information must be 
encrypted with products certified by NIST.*° Employees were prohibited from remotely 
processing classified or SBU/NOFORN (not releasable to foreign nationals) information.®' 
Employees were also required to (1) exercise "particular care and judgment" in remotely 
processing SBU information; (2) destroy SBU files saved on personally owned and managed 
information systems and removable media when the files are no longer required; and (3) 
implement and regularly update basic home security controls, including a firewall, anti-spyware, 
antivirus, and file-destruction applications. If an employee used a networked personally owned 
information system, he or she had to ensure that all information systems on the network 
implemented these security requirements. 

The FAH further prohibits the installation of non-Departmental information systems within 
Department facilities without the written authorization of DS and IRM.®' This provision replaced 
an identical FAM provision issued in 2008. 

In 2015, a new FAH provision was added regarding non-Department-owned mobile devices. The 
FAH provision included a rule requiring a 10-foot separation between a PDA and classified 
processing equipment, a ban on connecting to a Department network except via a Department- 


” Memorandum for the Heads of Executive Departments and Agencies and Independent Agencies: Managing 
Government Records Directive, M-12-18 (August 24, 2012). 

™ 5 FAM 872 (May 1, 2014). 

” 5 FAM 872.1 (May 1, 2014). 

“ 12 FAH-10 H-172.1 (September 25, 2014). These provisions are currently located at 12 FAH- 10 H- 173.1 (January 11, 
2016). 

12 FAH-10 H-172.4 (September 25, 2014). These provisions are currently located at 12 FAH-10 H-173.4 (January 11, 
2016). 

“ 12 FAH-10 H-112.14-2 (September 19, 2014). 
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approved remote-access program, and a requirement to conduct normal day-to-day 
Department operations on a Department information system because it has the proper security 
controls to protect Department information ® 

Applicable Cybersecurity Provisions and Related Guidance: The Federal Information Security 
Modernization Act of 2014, enacted in December 2014, updated FISMA by clarifying the roles of 
0MB and the Department of Homeland Security, improving security by moving away from 
paperwork requirements, and making improvements in the way that Federal data breaches are 
managed and reported.®^ Rules and guidance governing cybersecurity threats have not 
changed. 

Statutory and Regulatory Requirements for Email Records Preservation: In 2014, Congress 
enacted the Presidential and Federal Records Act Amendments of 2014, which amended several 
sections of the Federal Records Act.*^ It simplified the definition of record to: 

all recorded information, regardless of form or characteristics, made or received by a 
Federal agency under Federal law or in connection with the transaction of public 
business and preserved or appropriate for preservation by that agency or its legitimate 
successor as evidence of the organization, functions, policies, decisions, procedures, 
operations, or other activities of the United States Government or because of the 
informational value of data in them...*® 

The Act noted that the definition of "recorded information” includes "information created, 
manipulated, communicated, or stored in digital or electronic form." The Act also added a 
provision that prohibited agency employees from creating or sending a record from a non- 
official electronic messaging account unless they copy their official electronic messaging 
account in the original creation or transmission of the record or forward a complete copy of the 
record to their official electronic messaging account within 20 days.*^ 

The requirements in title 36 of the C.F.R. had not changed. 

FAM and FAH Requirements for Email Records Preservation: The requirements in the FAM 

generally had not changed. However, in October 2014, the Department issued an interim 
directive superseding some of the FAM requirements.®* The directive noted that employees may 
delete personal emails, but that "the only e-mails that are personal or non-record are those that 


12 FAH-IO H- 165.4 {May 20, 2015). 

Pub. L No. 113-283 (December 18, 2014). 

® Pub, L No, 113-187 (November 26, 2014). 

44 U.S.C. § 3301(a). 

® 44 U.S.C. 5 2911(a). 

Department of State, A Message from Under Secretary for Management Patrick F. Kennedy regarding State 
Department Records Responsibilities and Policy, Announcement No. 2014_10_H5, October 17, 2014. 
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do not relate to or affect the transaction of Government business." The directive also noted that 
departing employees may only take personal papers and non-record materials, subject to review 
by records officials. It reminded employees that "all federal records generated by employees, 
including senior officials, belong to the Department of State." Finally, the directive stated that: 

employees generally should not use private e-mail accounts (e.g., Gmail, AOL, Yahoo, 
etc.) for official business. However, in those very limited circumstances when it becomes 
necessary to do so, the email messages covering official business sent from or received 
in a personal account must be captured and preserved in one of the Department's 
official electronic records systems. The best way for employees to ensure this is to 
forward e-mail messages from a private account to their respective State account. Private 
email accounts should not be used for classified information. 

In October 2015, the Department updated the FAM to incorporate these requirements.®^ 

The responsibilities of Management Officers related to departing employees have not changed 
since Secretary Powell's tenure; however, in 2015, the Department changed the name of the 
separation form from OF-109 to DS-109. The pertinent language in the form did not change.* 

Other Preservation Guidance: In February 2013, the Department sent an announcement to all 
employees reminding senior officials that they may only take personal papers and non-record 
materials following a review by a records official to ensure compliance with Federal records laws 
and regulations.®^ 

In August 2013, NARA published a bulletin authorizing agencies to use a "Capstone" approach 
to managing email records, in lieu of print and file.®® The Capstone approach allows for the 
automatic capture of records that should be preserved as permanent from the accounts of 
officials at or near the top of an agency or an organizational subcomponent. In September 2013, 
NARA published a bulletin that stated that, "while agency employees should not generally use 
personal email accounts to conduct official agency business, there may be times when agencies 
authorize the use of personal email accounts." In these cases, "agency employees must ensure 
that all Federal records sent or received on personal email systems are captured and managed in 


® 5 FAM 443.7 {October 23, 2015). 

® 5 FAM 414.7 {June 19, 2015). 

” Department of State, Departing Senior Officials: Government Records and Persona! Papers, Announcement No. 
2013 J2„122, February 26, 2013. 

NARA, Guidance on a New Approach to Managing Email Records, Bulletin No. 2013-02 {August 29, 2013). In 2014, 
NARA and 0MB issued guidance on managing emails to be used in conjunction with NARA's Capstone guidance. 
Memorandum for the Heads of Executive Departments and Agencies and Independent Agencies: Guidance on 
Managing Email, M-14-16 (September 15. 2014). 
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accordance with agency recordkeeping practices.”®^ In 2015, NARA issued guidance on 
managing other forms of electronic messaging, including social media and texts.®^ 

On August 28, 2014, the Under Secretary for Management sent a memorandum to the Office of 
the Secretary, all Under Secretaries and Assistant Secretaries, and a number of other offices to 
remind them of their responsibility for creating, managing, and preserving records "regardless of 
physical format or media." It noted that "records may exist in many formats, including Instant 
Messages (IM) and records on mobile devices like BlackBerrys, mobile phones, and iPads." It also 
included specific requirements relating to emails, including: 

• At no time during designated senior officials' tenure will their e-mail accounts be cleared, 
deleted, or wiped for any reason. 

• While senior officials may delete personal e-mails, they should be aware that the 
definition of a personal e-mail is very narrow. The only e-mails that are personal are 
those that do not relate to or affect the transaction of Government business. 

• As a general matter, to ensure a complete record of their activities, senior officials should 
not use their private e-mail accounts (e.g., Gmail) for official business. If a senior official 
uses his or her private email account for the conduct of official business, she or he must 
ensure that records pertaining to official business that are sent from or received on such 
e-mail account are captured and maintained. The best way to ensure this is to forward 
incoming emails received on a private account to the senior official's State account and 
copy outgoing messages to their State account. ^ 


® N ARA. Guidance for agency employees on the management of federal records, including email accounts, and the 
protection of Federal records from unauthorized removal. Bulletin No. 2013-03 (September 9, 2013). 

NARA, Guidance on Managing Electronic Messages, Bulletin No. 2015-02 (July 29, 2015). 

® The Under Secretary sent this same message to all Chiefs of Mission in September 2014. 14 STATE 111506 
(September 15, 2014). 


ESP-16-03 


UNCLASSIRED 


64 


224 


UNCLASSIFIED 


APPENDIX B; MANAGEMENT RESPONSES 


UNCLASSIFIED 


TO; Inspector General - Steve Linick 

FROM: Transparency Coordinator - Janice L. Jacobs 

SUBJECT: OiG Draft Report - “Office of the Secretary: Evaluation of Email 
Records Management and Cybersecurity Requirements (ESP-16-03): Responses 
to Recommendations 


In March 2015, Secretary Kerry asked the Office of the Inspector General to 
review the Department’s efforts to preserve a lull and complete record of 
American foreign policy, and our procedures for making that record available to 
the American public. We welcome the opportunity to respond to your report. 
Office of the Secretary: Evaluation of Email Records Management and 
Cybersecurity Requirements, the fourth installment of your review. As your 
reports recognize, through our work with your office, as well as the Department’s 
efforts to meet Presidential and Department directives, we have made great 
progress towards a better preserved and more accessible public record. As 
demonstrated in the enclosed responses and comments to your specific 
recommendations, the Department is committed to continuing to improve. 
However, 1 also want to acknowledge and highlight how far we have already come. 

For decades, the government has been working to adapt longstanding 
recordkeeping principles and rules to the email-dominated modem era. The 
Federal Records Act and the Freedom of Information Act are established pillars of 
transparent government, but email and other communications technologies create 
difficult challenges for implementation. As your report describes, over the years 
the Department has been good at drafting principles on the importance of 
preserving email; however, only recently have we begun to match results with our 
aspirations. The National Archives and Records Administration (NARA) has 
acknowledged that die entire federal government — not just the State Department— 
continues to grapple with these challenges. In fact, NARA has issued some of its 
most relevant guidance regarding these matters in the last three years. 

Today, T can attest to the Department’s goal of leading on these issues in the 
future. Earlier this year. Secretary Keny issued a Department-wide notice on the 
critical importance of the Freedom of information Act, demonstrating a 
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commitment to transparency at the most senior level In September 20 1 5, 

Secretary Kerry announced my appointment as the Department’s Transparency 
Coordinator to oversee the Department’s efforts on these matters. At the time, the 
Department was already engaged in a process to meet the President’s Managing 
Government Records directive, including through the robust work of our Electronic 
Records Management Working Group. We are on track to meet the benchm^ks of 
the President’s directive for 2016; for example, your report notes that the 
Department is in the process of procuring new technology to manage emails 
electronically. 

In addition, in 20 1 4 the Department issued guidance on the use of personal 
emails — in effect anticipating later changes to the Federal Records Act — and 
initiated the Department’s implementation of the Capstone program in February 
2015 to archive automatically senior officials’ emails. Over 200 officials are 
already covered by Capstone, with more on the way. We also have already closed 
a number of the recommendations in your first three reports. 

Finally, the Executive Secretariat, Bureau of Administration, and other 
relevant bureaus have established a strong working relationship to improve records 
management. We are already cataloguing our current holdings of electronic 
archives, improving the way we search email records, and establishing procedures 
for archiving records going forward. 

As a result of these and other efforts, today the Department is much 
differently situated than during historical periods described in your report. It is 
clear that the Department could have done better at preserving emails of 
Secretaries of State and their senior staff going back several administrations. 
However, by early 2015, the Department had already taken important steps to 
address these issues. As noted above, our Electronic Records Management 
Working Group was already established. In addition, the Department had already 
received Secretary Clinton’s emails and undertook to release over 30,000 of them 
to the public. The National Archives and Records Administration concluded that 
our efforts with respect to Secretary Clinton and her senior staff mitigated past 
problems, as has a federal district court in a suit brought under the Federal Records 
Act. As you note in the report, you concur with this conclusion. 

The way we conduct diplomacy has evolved significantly in recent years 
from a time when official cables were one of the primary ways we communicated. 
Modem technology has unquestionably enhanced our mission; however, there is 
still work to do to ensure that we preserve a record of our work. We look forward 
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to working with your office in the future on these issues, and remain committed to 
building on what we have already accomplished. 
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UNCLASSIFIED 


TO: Inspector General - Slev'e Linick 

FROM: M - Patrick Kennedy 

SUBJECT: Drall report - ‘ OHice of the Secretary: Evaluation ol Email Records 
Management and Cybcrsccurilv' Requirements'' (ESP-16-03 dated May 2()!6) 

Thank you for the opportunil> to wrnmenl on subject draR report. Over the past 
year, the DeparUnent has taken steps to improve its records management practices 
and we believ’e we have made progress. However, more progress can be made, and 
vve arc committed to reaching the December 2016 goal set by NARA for email 
retention and continue advancing sound records management. 

Responses to rccommcndation.s from bureaus within tl)e M famih' follow below. 

Recommendation 1 : fhe Bureau of Administration should 

• issue guidance, including periodic, regular notices, to Department employees to 
remind them that the use of personal email accounts to conduct oRlcial business 
is discouraged in most circumstances, 

• clarify and give specific examples of the types of limited circiunstances in 
wliich such use would be pemiissible, and 

• instruct emplovees how to preserve Fedenil records when using personal email 
accounts. 

Department Response: The Bureau of Administration concurs with this 
recommendation and will continue to issue guidance on records management 
practices and ptilicies, and will ensure that this guidance explicitly reminds 
employes that the use of pcrstmal emails accounts to (x^nduct official business 
is discouraged. Similar to previous records maruigement guidance, such 
guidiince will be provided to empk>> ees in writing (via Department Notices and 
ALDACs) and in appropriate briefings (i.e. training courses, meetings, etc.) to 
remind employees of their responsibility for presen ing documentation of 
orticial activities, including emails. The Dcptirtmenl will consider additional 
means by which to inlbrm employees of a'cords management requirements and 
best practices. 
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Recommendation 2: i'hc Bureau of Administration should amend Uw l^'oreign 
Affairs Manual to relied the updates to Department recordkeeping sy stems that 
provide alterruilives to print aiil file. 

Department Response: We concur with this recommendation, but please 
edit to read '‘alternatives to irrinl and file emails that are records/ ' 

’ITic Bureau of Administration is currenth' working with the Office of the 
Tnmsparency Coordinator to update 5 FAM and chiipter subparls related to 
Departmenf s rccordkccping/rctcntion schedules. I'hc goal to eliminate the 
practice of print and file as tlie Dc|vartmcnt's policy and practice for the 
retention of emails by December 31, 2016, which is also the deadline by 
which the Departinent is sujipixsed to implement a solution to manage all 
emails. All other electronic documents slnvuld follow this electronic 
retention practice by the end of 2019. 

Recommendation 7: The Bureau of Infonnalion Resource Management (IRM) 
should 

• issue regular notices to remind Dcjvartmcnt employees of the risks associated 
with the use of non-Depanmcntal systems; 

• provide periodic briefings on such risks to stall at all levels; and 

• evaluate the cost and feasibility of conducting regular audits of computer 
system usage to ascertain the degree to which Department employees are 
follow ing the laws and policies concerning the use of personal email accounts, 

Department Response: The Department concurs with the first two bullet 
points of this recommendation. IRM will continue to issue regular notices 
regarding the risks ass<Kiaied with the ase of non-Departmenlal systems, 


Regarding the third bullet, audits conducted on such a wide scale would not 
be beneficial or feasible. Limited use of personal email is acceptable under 
current policy and allowable under law . The Depiirtmenl already conducts 
continuous momloring to ensure llie integrity of the Department networks 
and systems and in fact was a government leader in this regard. State's 
Conliiuwus Diagnostics laid Monitoring which is also known as iPost has 
been adopted and modified by DHS into the new gov ernment-wide 
Continuoas Diagnostics and Mitigation pmgram (CDM). Under 5 FAM 
724, the Department can audit an employee’s network activ'itv- or workstation 
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use, vsiiich includes but is limited to electronic communication, Internet 
access, local disk files, and scr\-cr files uticn there is suspicion that improper 
use of government equipment has occurred. In addition, Information 
Systems Security Officers (I^Os) worldwide are required to review 
systems and sccuriK logs on a regular basis. 

Regarding tlic first bullet point, the Bureau of Infonnation Resource 
Management continues to issue m>lices and provide briefings on risks 
ass<xiated witli the use of non-Departmenlal systems. For example: 

• Mandatory PS 800 Cyber Security Awareness Training course 

• Informational links 

o hUDs://intrunet.ds.state.sbu/DS/SI/CS/Avvarenessl/Contenl/Email..a 
spx for email, or 

o one level higher for other types of awareness infonnation 

• l>^iartmenl Notices (recent) 

o 2016_03 i28GlobalCvbcrForeignPolicy Training Workshop on 
April 25*29, 2016 

o 2016_02_035 Revised 12 FAM 620 and New' 12 FAII-10 
(Unclassified Cyber Security Policies) arc published 
o 201 5_l 1_063 October was National Cyber Security Awareness 
Montli 

• IT Customer Service Bulletins (e.g., 7/30/1 5) md also Inlbrmulion 
Announcements on 

hUD://inn.m.stale.sbu/sites/oDs/CSCMTSC/default.aspx 

• DSCybcrsccurity Awareness In Case You Missed It 

• Cyber Securin' Awareness month ~ October 

• Tips of the Day 

o Tips of the Day and StatcNct od\'crtiscmcnt on Protectinfi SBl ‘ 
Outside the Department and Protecting Personal Bnai! Accounts 

• Fact Sheet on Protecting Personal h'mail Accounts 

• Fact Sheet on Ihnv to flandle Suspicious Email (including personal 
email) 

• Fact Sheet on Email Safety 

• PersorKil Email Security Best Practices guide 

• Howto Rc^x>rt Suspicioas Mcssagcs/Activitv on Wcbmail Accounts 
guide 

• Safes blast emails on Personal Fmai! Addresses. Personal Fmail 
Reminder . How to Handle Suspicious Email. Sending SBU Over the 
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Internet Cloud Computing. Cloud Securin . IVotectins OnenNet When 
Accessing Personal L-mail Accounts 

• Awareness BuUelin on Personal Ftnail Accounts and Out of Office 
Messages 

• Personal Email Guides (Gmail Holmail, Yahoo, Oullwk) 

• Inlbniiation Systems Security (MTiccr (ISSO) Role-Based i raining - 
inandator> lor ISSGs 

• A- j (X) Foreign Service (lencralist class - general overview 

• '! radccraft 

o YW3 1 9 " IRM TradecralX lor the Irdbnnation Technology 
Manager 

o YW387 - Infonnation Restmrees Management Tradecraft 

• Diplomatic Security training Center (DS TC) summary’; 

o For FY 201 5 DS TC conducted 80 course sessions in dilTercnt 
cybersecuriU areas (including those lor ISSOs) 
o For FY-2016, DSTC has scheduled 81 dilTerent cybersecurity 
courses 

• Ainbassador/IH) and IX'M seminars -overview 

We will review whether the material in these notices and courses needs to be 
updated or exptinded. 

Recommendation 8: I he Director General of the Foreign Ser\ ice and Director of 
Human Resources should amend tlic h'tH'ei^n AJfairs Manual to j>ro\ idc lor 
administrative penalties for Dqmrtment employees who ( 1 ) fail to comply w ith 
rixordkccping laws and regulations or (2 ) fail to comply with the requirement that 
only authorized inlbnnalion s\ stems are to be used to conduct day-lo-da\ 
operations, 'llic amendment should include explicit steps cinplov ccs slwuld take if 
a rcastinablc suspicion exists that diKumcnts arc not being preserv ed appropriately, 
including a reminder that the OUlce of Inspector General has jurisdiction to 
investigate and refer to appropriate authorities sus|>cctcd v iolations of rccord.s 
preservation requirements. 

Department Response: The Department concurs with this recommendation 
and will implement it by revising, following any appropriate consultation 
with the unions, the lists of disciplinary offenses contained at 3 FAM 4377 
and 4542 to include explicitly violations of laws, regulations and directives 
regarding records management, including preservation. (At present, such 
offenses would fall into general catch-all imnisions contained in each list.) 


ESP-16-03 


UNCLASSIFIED 


71 





231 


UNCLASSIFIED 


Wilh respect to the second sentence of Recommendation 8, as part ot its 
continuing issuance of records guidance, tire Bureau of Administration, in 
coordination with the Bureau of Human Resources, will include guidance on 
how and where to raise records management concerns. Such guidance w ill 
remind employees of the jurisdiction of the OITice of Inspector General. 
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United States Department of State 
Washington, D,C 20520 
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May 16, 2016 


TO; 

FROM: 

SUBJECT: 


Steve Linick, Inspector General 

Joseph E. Macmanus, Executive Sec^tai 

Response to Draft OIG Review of EmaIrRe6ords Management 
and Cybersecurity Requirements Involving the Office of the 
Secretary 



The Executive Secretariat thanks the OIG for the opportunity to respond to this 
review. The Secretariat values the OIG’s study of electronic records management - 
a Department-wide challenge that we will continue to address. The Secretariat has 
the following specific responses to the recommendations contained in the report. 

Recommendation 3: The Office of the Secretary, Executive Secretariat, should 
work with the Office of Information Programs and Services to conduct an 
inventory of all electronic and hard-copy files in its custody and evaluate them to 
determine which files should be transferred to the Office of Information Programs 
and Services in accordance with records disposition schedules or Department email 
preservation requirements. 

Department Response: The Executive Secretariat agrees with this 
recommendation and notes that the inventory of electronic and hard copy 
files has been ongoing since January 2016. The Executive Secretariat agrees 
this is an important and necessary project. 


Recommendation 4: The Office of the Secretary, Executive Secretariat, should 
work with the Office of Information Programs and Services to adopt policies and 
procedures to ensure compliance by all employees within its purview, including 
the Secretary, with records management requirements. These policies should 
cover the retirement of records in accordance with records disposition schedules, 
preservation of email and other electronic records of departing officials, and 
training of employees in their records preservation responsibilities. 
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Department Response: The Executive Secretariat strongly agrees with the 
OIG recommendation that it should work closely with the Office of 
Information Programs and Services to fully implement policies and 
procedures to improve compliance with records management 
responsibilities, including the retirement of records in accordance with 
records disposition schedules, preservation of email and other electronic 
records of departing officials, and training of employees on their records 
preservation responsibilities. The Executive Secretariat staff is committed to 
coordinating closely with the Office of Information Programs and Services 
to provide updated guidance and training to all staff. 

Recommendation 5: The Office of the Secretary, Executive Secretariat, should 
work with the Office of Information Programs and Services to ensure that all 
departing officials within its purview, including the Secretary of State, sign a 
separation form (DS-I09) certifying that they have surrendered all Federal records 
and classified or administratively controlled documents. In addition, staff should 
ensure that all incoming officials within its purview, including the Secretary, 
clearly understand their records preservation and retention responsibilities, 
including records contained on personal email accounts. 

Department Response: The Executive Secretariat agrees with the OIG 
recommendation that it should ensure all departing officials within its 
purview, including the Secretary of State, sign a separation agreement form 
(DS-1 09), and that all incoming staff clearly understand their records 
preservation and retention responsibilities. The Executive Secretariat is 
instituting a process whereby employees’ completed DS-1 09 forms are 
placed in their permanent electronic performance files (eOPF) to ensure they 
easily accessible. 
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TO; Inspector General - Steve Linicfc 

FROM: Transparency Coordinator - Janice L. Jacobs 

SUBJECT: Draft report - “Office of the Secretaiy: Evaluation of Email Records 
Management and Cybersecurity Requirements” (ESP- 16-03 dated May 2016) 


Thank you for the opportunity to comment on subject draft report, which includes 
the following recommendation: 

“The Department’s Transparency Coordinator should work with the Office of 
Information Programs and Services to develop a quality assurance plan to promptly 
identify and address Department-wide vulnerabilities in the records preservation 
process, including lack of oversight and the broad inaccessibility of electronic 
records.” 

I concur and am happy to comply with your recommendation as part of my 
continuing efforts, in coordination with the Office of Information Programs and 
Services (A/GIS/TPS) and the Executive Secretariat (S/ES), to improve overall 
governance of the Department’s information - how it is captured, stored, shared, 
disposed of, and archived as appropriate. Your findings will help inform these 
efforts. The report’s focus on email records is particularly relevant given that all 
federal agencies have been directed by the White House and the National Archives 
and Records Administration (NARA) to manage all email records in an electronic 
format by December 3 1 of this year. Department progress towards this goal is well 
underway with measures either already in place or on the horizon. The Capstone 
program mentioned in your report, whereby the emails of designated senior 
officials are all captured and retained permanently, is one such step already taken 
by the Department. 
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By December 2019, all permanent electronic records in federal agencies must be 
managed electronically to the fullest extent possible. This will be a huge 
undertaking reK^uiring a governance structure for all forms of information created 
or received by the Department. The Department is committed to getting this right 
to help assure a 21^ century enterprise- wide information management system that 
advances the Department’s goals of increased efficiency, transparency and 
accountability. We will not succeed without sufficient metrics, quality controls, 
and general oversight of the system we create. This is why the quality assurance 
plan you’ve recommended is so important. 

As I move forward, I remain mindful of Secretary Kerry’s strong commitment to 
improving the Department’s records management and transparency systems in 
order to preserve the record of U.S. foreign policy and to share that story with the 
wider public. 
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ABBREVIATIONS 


A 

Bureau of Administration 

AIS 

Automated Information System 

CF.R. 

Code of Federal Regulations 

CIO 

Chief Information Officer 

CSIP 

Cyber Security Incident Program 

CTAD 

Cyber Threat Analysis Division 

D-MR 

Deputy Secretary for Management and Resources 

DCIO 

Deputy Chief Information Officer 

Department 

Department of State 

DIN 

Dedicated Internet Network 

DS 

Bureau of Diplomatic Security 

ERMWG 

Electronic Records Management Working Group 

FAH 

Foreign Affairs Handbook 

FAM 

Foreign Affairs Manual 

FIPS 

Federal Information Processing Standards 

FISMA 

Federal Information Security Management Act 

FOIA 

Freedom of Information Act 

GAO 

Government Accountability Office 

INR 

Bureau of Intelligence and Research 

IPS 

Office of Information Programs and Services 

IRM 

Bureau of Information Resource Management 

ISP 

Internet service provider 
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IT CCB Information Technology Change Control Board 

L Office of the Legal Adviser 

M Under Secretary for Management 

NARA National Archives and Records Administration 

NIST National Institute of Standards and Technology 

NOFORN not releasable to foreign nationals 

OIG Office of Inspector General 

0MB Office of Management and Budget 

PDA personal digital assistant 

.pst Personal Storage Table (Microsoft Outlook file format) 

S Office of the Secretary 

S/ES Office of the Secretary, Executive Secretariat 

S/ES-EX Office of the Executive Director, S/ES 

S/ES-IRM Office of Information Resources Management, S/ES 

SAO Senior Agency Official 

SBU sensitive but unclassified 

SMART State Messaging and Archive Retrieval Toolset 
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OIG TEAM MEMBERS 


Jennifer L. Costello, Team Leader, Office of Evaluations and Special Projects 

David Z. Seide, Team Leader, Office of Evaluations and Special Projects 

Jeffrey McDermott, Office of Evaluations and Special Projects 

Robert Lovely, Office of Evaluations and Special Projects 

Michael Bosserdet, Office of Inspections 

Brett Fegley, Office of Inspections 

Kristene McMinn, Office of Inspections 

Timothy Williams, Office of Inspections 

Aaron Leonard, Office of Audits 

Phillip Ropella, Office of Audits 

Kelly Mingheila, Office of Investigations 

Eric Myers, Office of Investigations 


ESP-16-03 


UNCLASSinED 


79 



239 


UNCLASSIFIED 



HELP FIGHT 

FRAUD. WASTE. ABUSE. 

1-800-409-9926 
OI6.state.gov/HOTLIN E 
If you fear reprisal, contact the 

OIG Whistieblov/er Ombudsman to learn more about your rights: 

OIGWPEAOmbuds@state.gov 


oig.state.gov 

Office of Inspector General • U.S. Department of State • PO. Box 9778 • Arlington, VA 22219 
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MEMORANDUM 


TO; 
FROM 


^atrick F. Kennedy, Under Secretary for Management, Department of State 


k\M 

AV J Steve A, Linick, Inspector General, Department of State 

I. Charles McCullough, III, Inspector General, Intelligence Community 


SUBJECT: Potential Issues Identified by the Office of the Inspector General of the 

Intelligence Community Concerning the Department of State's Process for the 
Review of Former Secretary Clinton's Emails under the Freedom of Information 
Act {ESP-15-04) 


The Office of Evaluations and Special Projects within the Office of Inspector General (OIG) is 
reviewing the use of personal communications hardware and software by five Secretaries of 
State and their immediate staffs. This work includes an evaluation of the Department of State's 
ongoing efforts to publish the emails of former Secretary of State Clinton, which were provided 
to the Department in December 2014. To assist in the review, OIG consulted with the Office of 
the Inspector General of the Intelligence Community (ICIG). 


ICIG staff conducted a preliminary assessment of the Department's ongoing Freedom of 
Information Act (FOIA) process for the Clinton emails, including 296 emails publicly released by 
the Department on May 22, 2015. This preliminary assessment identified four areas that require 
immediate attention by Department leadership. Attachment A contains OIG's and ICIG's 
Memorandum, dated June 19, 2015, which makes four recommendations related to these areas. 
Attachment B contains your June 25, 2015, and July 14, 2015, responses. Based on these 
responses, OIG and ICIG consider two of these recommendations to be closed, whereas the 
other two remain unresolved. Attachment C contains more detailed information about the status 
of each recommendation. 


U.S. Department of State, Office of Inspector General. Washington, D.C 20522-0308 



241 


UNCLASSIFIED 


On June 29, 2015, OIG and ICIG sent you a follow-up memorandum providing additional 
information supporting our concerns about the FOIA process used for the Clinton emails (see 
Attachment D). Since then, ICIG has received confirmation from IC FOIA officials that several of 
these emails contained classified IC information, though they were not marked as classified. In 
addition, at least one of these emails has been released to the public and can be accessed on 
the Department's FOIA website. OIG and IQG will continue to assess whether further actions 
need to be taken to ensure that no additional classified information is publicly released. 

Attachments : As stated. 

cc D(MR) - Heather A. Higginbottom 
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OIG an^IClG Memorandum to the Department, Dated June 19, 2015 

l OIG Office of Inspector General 

U.S. Department of State - Broadcasting Board of Governors 
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June 19, 2015 


MEMORANDUM FOR UNDER SECRETARY KENNEDY 


FROM; 


// 


Steve A. Linick, Inspector General, Office of Inspector General, Department of State 
I. Charles McCullough, in, Inspector General, Intelligence Community 


SUBJECT: Potential Issues Identified by the Office of the Inspector General of the 

Intelligence Community Concerning the Department of State's Process for the 
Review of Former Secretary Clinton's Emails under the Freedom of Information 
Act (ESP-15-04) 


Pursuant to a notification letter dated April 16, 2015, the Office of Evaluations & Special Projects 
within the Office of the Inspector General (OIG) is reviewing the use of personal communications 
hardware and software by five Secretaries of State and their immediate staffs. On June 4, 2015, 
OIG notified the Department of State (Department) that this review would include an evaluation 
of the Department's ongoing efforts to review, categorize, and publish the e-mails of former 
Secretary of State Clinton, which were provided to the Department in December 2014. To assist 
in the review, OIG consulted with the Office of the Inspector General of the Intelligence 
Community (ICIG), As part of the ongoing review, ICIG staff conducted a preliminary assessment 
of the Department's Freedom of Information Act (FOIA) review process as well as 296 emails 
released by State FOIA officials on May 22, 2015. This preliminary assessment identified four 
areas that may require immediate attention by Department leadership. The ICIG Memorandum 
for the Record containing recommendations and an accompanying cover letter from the 
Inspector General of the Intelligence Community are attached. 

Please provide comments to the ICIG Memorandum and information on actions taken or 
planned on each of the recommendations, no later than close of business, Friday, June 26, 2015, 
to Inspector General Steve A. Linick 4t|^B||||||m^| and to Inspector General I. Charles 
McCullough If you have any questions about this request, please contact 

I. Charles McCullough, III at|||||||||H|[m|||. Thank you for your attention to this matter. 


Attachments : As stated. 

cc: D-MR - Heather A. Higginbottom 


U.S. Department of State, Office of Inspector General, Washington, DC 20522-0308 
3 

UNCLASSIFIED 




243 


UNCLASSIHED 

UNCLASSIFIED//FOeQ 



bSPSCTOR G£NiE.U Ot THE iNTEtUGENCf CO.'.iMUM 
V.'.iSHrNGTCN. DC 20511 


15 June 2015 


The Honorable Steve Linick 

Inspector General 

Department of State 

2201 C Street, NW (SA-3. Suite 8100) 

Washington, DC 20520 

Dear Mr. Linick: 

(U/ /FOUO ) Thank you for reaching out to my office to assist you in your 
current review entitled "Use of Personal Communications Hardware and Software 
by Five Secretaries of State and Their Immediate Staffs.” Thus far. our assistance 
has been tailored to reviewing State Department’s Freedom of Information Act 
(FOIA) process and how classified Information is safeguarded in that process. 

(U/ / - FOUO ) Our preliminaiy review identified four areas that may require 
immediate attenUon by State FOIA officials, in coordinaUon with Intelligence 
Community FOIA officials. Those areas are detailed in the attached memorandum. 
My team has briefed your team members on these developments and will continue 
to refine findings and recommendations as the review progresses. 


Sincerely. 



1. Charles McCullough. Ill 


cc: David Seide, Counselor. 

State Department Office of Inspector General 

Genera] Counsel 

General of the Intelligence Community 


Office of the Inspector 


Attachm ent: 
(U) MFR.H 


(dtd 15 June. 2015) (U/ /FOiJ O) 
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OFn:;E oftue Ln'spector General ofthe Intelligence Commitvity 
Inspections AiND Evaluations Division 

WaSHLNGTON, DCI05 1 1 


MEMORANDUM FOR THE RECORD 


PROJECT: 


INSPECTOR; 

PURPOSE: 


15 June 2015 

(Ul Special Inquiry 2015-001: Assistance to State 
Department Inspector General Review of Use of Personal 
Communications Hardware and Software by Five 
Secretaries of State and Their Immediate Staffs 



(U/ /FOUO ) Document Potential Issues Identified in 
Preliminary Review of the State Department FOIA 
Process. 


{U//FOUO) The Office of the Inspector General of the Intelligence 
Community (IC IG) is assisting the State Department IG’s office in the above 
referenced review, focused on the handling of potentially classified material during 
the State Department Freedom of Information Act (FOIA) review process. I am 
conducting a preliminary review of the handling of potentially classified material 
during the State FOIA review process being used to review the 33.000 emails 
provided by former Secretary Clinton from her personal email server. Thus far. I 
have identified four areas that may require expedited attention by State FOIA 
officials, in coordination with IC FOIA officials. Those areas are: 

1. (U/ /FOUO) Bvaluation of other agencies' equities is not optimal. State 
Department is currently relying on retired senior Foreign Service Officers to 
review for other agencies' equities in FOIA cases. For example, a review of 
the first set of 296 emails received from former-Secrelary Clinton and 
released on the State Department FOIA website identified material that 
should have been referred to IC FOIA officials for review prior to release. 
Recommend State Department FOIA Office request staff support from 
IC FOIA offices to assist in the identification of intelligence community 
equities. 


This is a deuberative process document and intended solely for official use by the IC IG. 
Recipients may not further disseminate without the express permission of IC IG personnel. 

UNCLASSIFIED//Fese 

5 

UNCtASSlRED 


245 


UNCLASSIFIED 


mciASSiPiED//eem 

(U//fOVO) Document Potential Issues Identlfled in Preliminaiy Review of the 
State Department PX)IA Process. 


2. (U/^f!:eDO]StmrageaBddistzftiitlonofFOIA.iiiateiiallsaceiinliigona 
^CBBT kvd aetwork. State Department is using a SECRET level 
network (C3assNet) to store the 33,000 emails acquired from formo'- 
Secretary Clinton. State is also using ClassNet to distribute the FOIA 
material for review]^ both the Intra-and-lnter-agengr. Matmlalatthe 
SECRET/ /NOFORN Imvel was Identified in the first set of 296 emails prior to 
theirrelease. Reownmend IC FOIA ofiBeeis review the wnails to ensige 
OasSNet use is i^ptoptlate before txaasmlttlag to the State Bnreans for 
review. 

3. (U/^et?^A|»plyiiig appropriate FtMAeaem^ions to protect dasrifled 
inibnnatom. State Department FOIApersonnel recommended five 'Bl* 
(Clashed National Security Information) FOIA exenqitions for proposed 
redstetfons in the first set of 296 emails to protect dasslfied information. 
According to State FOIA personnel, during the State Department L^al 
Office’s review, four of the B1 exemptions were removed and changed to 
‘‘BS” FOIA exemptions (PrtvU^ed Communications). Recominend Stote 
Department FOIA Office seek clasdfleation expMtise fimm the 
interagency to act as a final arbiter If there Is a qnestlon regarding 
potentially classified materials. 

4. (U//FOB^ It is andear if the Department of Jnstiee is revtewing the 

befine FOIA release. Pormer-Secietaiy Clinton’s emails are the 
subject of numerous FOIA requests and multiple FOIA lawsuits. It may be 
prudent to Integrate the Department of Justice Into the PCHA process review 
to ensure the redactions can withstand potential l^al c h all en ges. If not 
already being done, reeommend the State Department FOIA OfiBce 
incoipotate the Department of Jhstiee into the FOIA process to ensue 
tiift legal sufficiency review of the FOIAenemptiens and red actions . 


2 
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ATTACHMENT B 


UNCLASSinED 


Department's Responses to ICIG Recommendations 

UNDER SECRETARY OF STATE 

FOR MANAGEMENT 
WASHINGTON 


UNClASSiKlED 

MEMORANDUM FOR THE INSPECTOR GENERAL 


FROM: 

SUBJECT: 


M - Patrick F. Kennedy 

Potential Issues Identified by the Office of the Inspector General of the 
Intelligence Community Concerning the Department of State’s Process for the 
Review of Former Secretary Clinton's Emails under the Freedom of Information 
Act (ESP- 15-04) 


I am in receipt of the subject Memorandum (dated June 19, 2015) and its accompanying 
Memorandum and Attachment from the Inspector General of the Intelligence Community 
(tClG). Responses to the four recommendations are contained in the attached. 


The Department of State's FOIA processes are consistent with of those of other agencies. 
State's FOIA personnel analvve responsite records for disclosure pursuant to the provisions of 
the FOI.A and apply exemptions to the documents as appropriate. Department FOIA reviewers 
are trained in applying the exemptions, using guidance made available by the Department of 
Justice's Office of Information Policy, The reviewers consult with subject matter experts in 
Department components and with FOIA attorneys in the Department's Office of the Legal 
Adviser, as appropriate. In turn, the Department's attorneys consult regularly with attorneys at 
DOJ's Federal Programs Branch and attorneys at U.S. Attorney's Offices on legal issues that 
arise in the context of the FOIA and FOIA litigation. Consistent w ith the long-standing practice 
of third-agency review within the lixecutive branch and DOJ Policy on Referrals, Consultations, 
and Coordination, the Department consults with other agencies with respect to the review and 
disclosure of records that contain information that is of interest to another agency. 

Taking the above in account, the Department finds the issues raised by tlie ICIG are 
either already addressed in current processes or are inconsistent with interagency practices. 
Further, the recommendations provided by the ICIG would add to the FOIA review process 
schedule and make it more difficult to meet the U.S. District Court order for rolling productions 
without meaningfully enhancing the review process. 


Attachment: 
As stated. 


UNCLASSIFIED 
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Recommendation #1 


The process utilized by the State Department to identify other agency equities is one with 
parallels throughout the United States Government. 

Prior to undertaking the current effort, a senior level meeting was held with representatives of 
a number of agencies (including the CIA and ODNI): the process to be utilized was outlined; and 
no objection was entered. 

The retired senior Foreign Service Officers are utilized because of their years of both FOIA 
experience and substantive expertise in the various regional and functional issues that are 
reviewed. 

If there are specific examples from the “Benghazi” 296 set that are of concern, the 
Department would welcome further information. 

Recommendation #2 


The State Department Classified network is authorized to handle up to SECRET material, 
including NOFORN, and thus ClassNet is the appropriate system for the storage and distribution 
of these FOIA materials. 

Should the Department identify an e-mail that potentially contains material that could be 
classified at a higher level, that material would be pulled from the database and transmitted for 
review via an appropriate channel. 

Recommendation #3 

Final determinations of classification decisions are made by senior personnel within the 
Department’s FOIA office, assisted by subject matter experts in relevant bureaus and in the 
Office of the Legal Adviser, after referral of other agency equities have been made to the 
appropriate agencies and their comments received. These individuals have the experience and 
expertise necessary to carry out this responsibility correctly. 

Recommendation #4 

Emails with Department of Justice equities (including those of its component entities) are 
forwarded to the relevant DOJ entities for review. Legal sufficiency review of the FOIA 
exemptions and redactions are conducted by attorneys from the Office of the Legal Adviser; they 
consult regularly with the Department of Justice's Federal Programs Branch regarding FOIA 
issues and litigation, including litigation involving the former Secretary’s emails. This type of 
process is common throughout the interagency. 


UNCLASSIFIED 
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United States Department of State 

Under Secretary of State 
for Management 

Washington, D.C. 20S20 
July 14, 2015 

MEMORANDUM FOR THE INSPECTOR GENERAL 

FROM: Patrick F. Kennedy 

SUBJECT: Potential Issues Identified by the Office of the Inspector General of 

the Intelligence Community Concerning the Department of State’s 
Process for the Review of Former Secretaiy Clinton’s Emails under 
the Freedom of Infonnation Act (ESP-15-04) 

The following information is provided in response to your request for supplemental 
information. First, the Bureau of Administration’s Global Infonnation Services 
(A/GIS) has been in contact with the Director of ODNI’s Information Management 
Division and is making arrangements for the Intelligence Community (IC) to 
provide reviewers to assist the Department of State in identifying potential 1C 
equities in its review of former Secretary Clinton’s emails. A/GIS is expecting to 
host more than 10 IC reviewers and will be holding an orientation for the reviewers 
on July 15. 

Second, as we explained, CLASSNET is a secure, classified intranet system. It 
may be used to process information up to and including SECRET. Should any of 
the documents in the FOIA review be upgraded to a higher classification than 
SECRET, they would be moved off CLASSNET. Resource constraints preclude 
conducting the entire FOIA review on a TOP SECRET system. 

Regarding the third recommendation, four of the documents were identified for 
review by the Bureau of Near Eastern Affairs (NEA), which is the bureau with 
relevant subject matter expertise; two of the documents were substantively 
duplicates of each other. NEA consulted witli the Office of the Legal Adviser 
regarding FOIA exemptions that u'ere potentially available, including exemptions 
1 (§ 1.4(d) of E.O. 13526) & 5. NEA decided, consistent with the Attorney 
General’s 2009 FOIA guidance, to redact certain limited information under 
exemption 5 which reflected deliberations among policy officials. Two other 
documents were proposed for possible upgrade which involved equities of other 
agencies. In one document, the Department of Defense decided not to seek a 
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UNCLASSIFIED 
- 2 -' . 

classification upgrade. The other document, which contained an FBI equity, could 
have been redacted under either exemption 1, pursuant to § 1.4 (d) of E.0. 13526, 
or exemption 7, as law enforcement information. 

Fourth, as noted previously. Department attorneys consult regularly with die 
Deparhnent of Justice’s Federal Programs Branch on legal issues fliat arise in the 
context of the FOIA and FOIA litigation. This practice is longstancfing and 
continues with respect to this review; L attorneys met with attorneys fi-om Federal 
Programs on Monday of this week. 
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ATTACHMENT C 

OIG and ICIG Response to the Department 

Recommendation 1: The State Department FOIA Office should request staff support from IC 
FOIA offices to assist in the identification of intelligence community equities. 

Management Response: The Department’s July 14, 2015, response (July 14 response) states that 
the Bureau of Administration's Global Information Services (A/GIS) has been in contact with the 
Director of ODNI's Information Management Division and is making arrangements for the 
Intelligence Community (IC) to provide reviewers to assist the Department of State in identifying 
potential 1C equities in its review of former Secretary Clinton's emails. A/GIS is expecting to host 
more than 10 IC reviewers and will be holding an orientation for the reviewers on July 15. 

OIG and IQG Reply. OIG and ICIG consider this recommendation to be closed. A/GIS has made 
arrangements for the IC reviewers and these additional reviewers will assist the Department of 
State in identifying potential IC equities in its review of former Secretary Clinton's emails. The 
additional IC reviewers will assist in identifying and safeguarding IC information, OIG and ICIG 
will continue to assess the State FOIA review process and the implementation of this 
recommendation. 

Recommendation 2: IC FOIA officers should review the emails to ensure ClassNet use is 
appropriate before transmitting to the State Bureaus for review. 

Management Response: The Department's June 25, 2015, response (June 25 response) states 
that the State Department Classified network is authorized to handle up to SECRET material, 
including NOFORN, and thus ClassNet is the appropriate system for the storage and distribution 
of these FOIA materials. The July 14 response further states that resource constraints preclude 
conducting the entire review on a TOP SECRET system. 

OIG and ICIG Reply OIG and ICIG consider this recommendation to be unresolved. The ICIG 
understands the resource constraints presented by conducting the entire FOIA review on a TOP 
SECRET system. However, given that it is more likely than not that information classified higher 
than SECRET is present in this collection, it is prudent to seek an alternative to the ClassNet 
system. 

Recommendation 3: The State Department FOIA Office should seek classification expertise from 
the interagency to act as a final arbiter if there is a question regarding potentially classified 
materials. 

Management Response: The June 25 response states that final determinations of classification 
decisions are made by senior personnel within the Department’s FOIA office, assisted by subject 
matter experts in relevant bureaus and in the Office of the Legal Adviser, after referral of other 
agency equities have been made to the appropriate agencies and their comments received. 
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The July 14 response refers specifically to four emails that were identified for additional 
consultations regarding a proposed “Bl" (Classified Information) FOIA exemption being 
changed to a "B5" (Privileged Communications) FOIA exemption during the State Department 
Legal Office's review. The July 14 response states the following: 

Four of the emails were identified for review by the Bureau of Near Eastern Affairs 
(NEA), which is the Bureau with relevant subject matter expertise; two of the 
documents were substantively duplicates of each other. NEA consulted with the 
Office of the Legal Adviser regarding FOIA exemptions that were potentially 
available, including Bl (§ 1.4 (d) of E.0. 13526) and B5. NEA decided, consistent 
with the Attorney General's 2009 FOIA guidance, to redact certain limited 
information under exemption B5 which reflected deliberations among policy 
officials. Two other documents were proposed for possible upgrade which 
involved equites of other agencies. In one document, the Department of Defense 
decided not to seek a classification upgrade. The other document, which 
contained an FBI equity, could have been redacted under exemption 1, pursuant 
to § 1.4 (d) of E.0, 13526, or exemption 7, as law enforcement information. 

OIG and IQG Reply; OIG and ICIG consider this recommendation to be unresolved. DIG and 
ICIG are assessing the information provided in the July 14 response and will further advise the 
Department after the assessment is completed. Consulting with State Department experts may 
be sufficient to protect classified State Department equities. However, the information may also 
be classified due to intelligence equities. OIG and ICIG reiterate the need to seek classification 
expertise from the interagency to act as a final arbiter if there is a question regarding potentially 
classified materials. 

Recommendation 4; If not already being done, the State Department FOIA Office should 
incorporate the Department of Justice into the FOIA process to ensure the legal sufficiency 
review of the FOIA exemptions and redactions. 

Management Response: The June 25 response stated that emails with the Department of Justice 
(DOJ) equities (including those of its component equities) are fonwarded to the relevant DOJ 
entities for review. Legal sufficiency review of the FOIA exemptions and redactions are 
conducted by attorneys from the Office of the Legal Adviser; they consult regularly with the 
DOJ's Federal Programs Branch regarding FOIA issues and litigation, including litigation 
following the former Secretary's emails. This type of process is common throughout the 
interagency. 

OIG and IQG Reply. OIG and ICIG consider this recommendation to be closed. 


12 

UNCLASSIFIED 



252 


ATTACHMENT D 


UNCLASSMED 


OIG 



Memorandum to the Department, Dated June 29, 2015 

OIG Office of Inspector General 

U,S. Department of State • Broadcasting Board of Governors 


UNCLASSIHED 


June 29, 2015 


MEMORANDUM FOR UNDER SECRCTARY KENNEDY 




Steve A. Linick, Inspector General, Department of State 

!. Charles McCullough, ID, Inspector General, Intelligence Community 


SUBJECT; Potential Issues Identified by the Office of the Inspector General of the 

Intelligence Community Concerning the Department of State's Process for the 
Review of Former Secretary Clinton's Emails under the Freedom of Information 
Act (ESP-15-05) 


We understand that, in compliance with a federal court order connected to pending Freedom of 
information Act (FOIA) litigation, the Department plans to publish tomorrow a portion of the 
55,000 pages of emails produced by former Secretary Clinton. We are therefore providing this 
Memorandum as follow up to our June 19, 2015, Memorandum to you, to provide additional 
information supporting our concerns about the current process underway to review the 55,000 
pages of emails prior to publication. 

On June 26 and June 27, 2015, Department staff responsible for FOIA issues further reviewed a 
portion of the 55,000 pages that have been or are to be reviewed. They report discovering 
hundreds of potentially classified emails within the collection. In addition, there is concern that 
possible classified material will be posted in tomorrow's release. Staff members from the Office 
of Inspector General for the Intelligence Community (IC IG) are now taking steps to verify the 
dassification of some of these emails. 


Under the circumstances, we continue to urge the Department to adopt the recommendations 
made by the IC IG in our June 19 Memorandum in order to enhance the current review system 
and to further minimize risk. The Department should ensure that no classified documents are 
publically released. 


cc: D-MR - Heather A. Higginbottom 


ESP-15-05 


U S, Dep^nmem oi Srale, Otficc of Inspector General, Wsshingion, DC ZQSZZdSOS 
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iNSPtnoR Genera! oe imf Intelligence COMMLXiT-, 

T\ .XSi itNGTUN, DC 20511 


14 January 2016 


The Honorable Richard Burr 
Chairman 

Select Committee on Intelligence 
U.S. Senate 

Washington D.C. 20510 

The Honorable Bob Corker 
Chairman 

Foreign Relations Committee 
U.S. ^nate 

Washington D.C. 20510 


SUBJECT: IC IG Response to Congressional Inquiry 
Dear Chairman Burr and Chairman Corker: 

Thank you for your recent inquiry regarding the classificaUon determination 
processes used within the Intelligence Community (IC) for reviewing former Secretary 
of State Clinton's emails. In response to your inquiry. 1 requested sworn declarations 
from two 1C elements involved In the Freedom of Information Act (FOIA) review process 
for these emails. 

To dale. I have received two sworn declarations from one 1C element. These 
declarations cover several dozen emails containing classified information determined 
by the IC element to be at the CONFIDENTIAL. SECRET, and TOP SECRET/SAP 
levels. According to the declarant, these documents contain information derived from 
classified IC element sources. Due to the presence of TOP SECRET/SAP information, 1 
provided these declarations under separate cover to the Intelligence oversight 
committees and Senate and House Leadership. The IC element is coordinating with 
State to determine how these documents should be properly treated in the FOIA 
litigation. 
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The Honorable Richard Burr 
The Honorable Bob Corker 

I have yet to receive a declaration from the second classifying 1C element, and 
have referred the matter to the IG of that 1C element for follow-up. 

You also requested that my office update you on the status of the two open 
recommendations made in our 15 June 2015 memorandum to State. There Is no 
change since our last reporting. Recommendation 2 that State review the use of a 
SECRET-level IT system for the FOIA review remains unresolved. The State OIG is still 
assessing issues related to Recommendation 3 that the State FOIA office seek 
interagency classification expertise in applying appropriate FOIA exemptions. 

If you have any questions or concerns, please contact me or my 
Legislative Counsel, Melissa H. Wright, at 571-204-8149. 


Sincerely. 



I. Charles McCullough. Ill 


cc: 


The Honorable Dianne Felnstein 
The Honorable Ben Cardin 
The Honorable Devin Nunes 
The Honorable Adam Schiff 

The Honorable James Clapper, Director of National Intelligence 
The Honorable Steve Linick. Inspector General. Department of State 
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Opening Statement 

Ranking Member Elijah E. Cummings 

Emergency Hearing with FBI Director James Comey 
July 7. 2016 

Director Comey, thank you for being here today. I want to begin by commending you 
and the public servants at the FBI for the independent investigation you conducted. 

You had a thankless task. No matter what recommendation you made, you were sure to 
be criticized. There is no question that you were extremely thorough. In fact, some may even 
say you went too far in your investigation. But of course, that was your job. 

Secretary Clinton has acknowledged that she made a mistake in using a personal email 
account. And you explained on Tuesday that she and her colleagues at the State Department 
were extremely careless with their emails. 

But after conducting this exhaustive review, you determined that no reasonable 
prosecutor would bring a case based on this evidence, and you and the career staff recommended 
against prosecution. 

Based on the previous cases you examined, if prosecutors had gone forward, they would 
have been holding the Secretary to a different standard than everyone else. 

Amazingly, some Republicans who were praising you just days ago for your 
independence and integrity and honesty instantly turned against you because your 
recommendation conflicted with the predetermined outcome they wanted. 

In their eyes, you had one job — and one job only — to prosecute Hillary Clinton. But you 
refused, so now you are being summoned here to answer for your alleged transgressions. 

Contrary to the claims of your critics, there is absolutely no evidence that you made your 
recommendation for political reasons, no evidence that you were bribed or coerced or influenced, 
and no evidence that you came to your conclusion based on anything but the facts and the law. 

Today, House Republicans are doing what they always do — using taxpayer funds to 
continue investigating claims that have already been debunked just to keep them in the headlines 
one more day. 
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When they hear a political siren, they rush towards it over and over again — even if the 
evidence is not there. 

Exhibit A is Majority Leader Kevin McCarthy, who admitted on national television that 
Republicans established the Benghazi Select Committee to bring down Secretary Clinton’s poll 
numbers. This fact was confirmed by a Republican staffer on that Committee who reported that 
he was fired in part for not going along with the “hyper focus” on Secretary Clinton. 

I give House Republicans credit — they certainly are not shy about what they are doing. 
They have turned political investigations into an art form. 

If our concerns here today are with the proper treatment of classified information, then 
we should start with a review of our previous hearing on General David Petraeus, who pled 
guilty last year to intentionally and knowingly compromising highly classified information. 

I’he problem is, we never had that hearing. This Committee ignored that breach of 
national security because it did not match the political goals of House Republicans. 

If our concerns today were with finally addressing a broken classification system in 
which security levels are arbitrarily changed up and down, that would have been a legitimate 
goal. That would have been a valuable addition to reforming and improving our government. 

We could have held today’s hearing on the Zika virus, preventing gun massacres like the 
one in Orlando, or a host of other topics that could actually save people’s lives. 

But that is not why we are here. That is not why our Chairman called this emergency 
hearing 48 hours after Director Comey made his recommendation. Everyone knows what this 
Committee is doing, and it’s an abuse of taxpayer dollars for political purposes. 

Honestly, I would not be surprised — and I say this with all seriousness — I would not be 
surprised if tomorrow House Republicans set up a new committee to spend another $7 million on 
why the FBI failed to prosecute Hillary Clinton. 

Director Comey, let me conclude with this request. Even with all I have said, I believe 
there is a critical role for you here today. 1 have listened carefully to the coverage on this issue, 
and I have heard people say, as recently as this morning, that they arc mystified by your decision. 
There is a perceived gap betvs^ecn the things you said on Tuesday and your recommendation. 

So this is your moment. Fill in that gap. Share with us and the American people your 
process and your thinking. Explain how you examined the evidence, the law, and the precedent. 
Describe in clear terms how you and your team of career professionals arrived at this decision. If 
you can do that today, that could go a long way towards helping people understand your 
decision. 

Finally, I want to make clear that I condemn these completely unwarranted political 
attacks against you. They have attacked you personally, they have attacked your integrity, they 
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have impugned your professionalism, and they have even suggested that you were somehow 
bought and paid for because you made your recommendation based on the facts, 

I know you are used to working in the world of politics, but these attacks are beyond the 
pale. You do not deserve this. Your family does not deserve this. And the highly skilled and 
dedicated agents at the FBI do not deserve this. 

I honor your professionalism and your service to our country, and I thank you for being 
willing to testify here today on such incredibly short notice. 


Contact: Jennifer Werner, Communications Director, (202) 226-5181. 
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